Active Directory uses the Kerberos protocol for authentication. As it is an old protocol, numerous security hardening measures have been taken since its creation, and some legacy options must be disabled to ensure proper security posture.

An attacker can use the AS-REP Roasting attack to guess the users' passwords. The first part of the AS-REP Roasting attack is to identify users for whom the Kerberos pre-authentication is not set (DONT_REQ_PREAUTH). This is part of the userAccountControl attribute.

Without Kerberos pre-authentication, an attacker can send an authentication request (AS-REQ) to the KDC on behalf of the user. The KDC will then reply with an encrypted TGT (AS-REP). A part of the AS-REP is encrypted with the original user's key, derived from their own password. The attacker can then use offline bruteforcing to guess the password. This attack is much faster than online bruteforcing (e.g. by making numerous authentication requests with different passwords).

Pre-authentication forces the attacker to be in possession of the password (by having to encrypt a timestamp) before the KDC sends back the encrypted TGT.

By default, this check skips disabled accounts. To also check disabled accounts, please enable thorough tests.

Note: The AD Starter Scan and associated plugins are intended to be used with smaller AD deployments for purposes of preliminary analysis. Accurate preliminary analysis can be expected for AD deployments with up to 5000 users, groups or machines and incomplete results will be returned for larger AD deployments with Nessus, Security Center and Vulnerability Management. For more information on the issues discovered by the Active Directory Starter Scan plugins, please refer to this blog post - https://www.tenable.com/blog/new-in-nessus-find-and-fix-these-10-active-directory-misconfigurations

Detections

Analytics

AD Starter Scan - Kerberos Pre-authentication Validation

medium Nessus Plugin ID 150482

Version 1.110