Skip to content
Remove SPNs and Fix Kerberoasting
projectblack.io | research | #remediation | #active-directory | #privilege-escalation | #hardening | #kerberoasting | #spn
Summary
A Kerberoasting remediation guide: check whether an SPN is still in use via Event ID 4769, then remove unneeded SPNs with setspn or ADUC. Also covers the impact of deleting actively used SPNs.
- Published
- Collected