How to Protect Active Directory Against Kerberoasting: AD Security 101

Golden Ticket attacks forge Kerberos TGTs using the KRBTGT account hash to gain unrestricted domain access. Explains Kerberos and KRBTGT basics, how Mimikatz is used, and defensive tactics.

Explainer on AD Golden Ticket attacks: attackers forge Kerberos tickets to gain access to your organization's IT environment; the post covers basic security hygiene and building layered defenses against them.

Kevin Robertson details ten attacker rules for MachineAccountQuota, which lets unprivileged users add up to 10 machine accounts, plus Powermad techniques and the defense of setting MAQ to 0.

Introduces Invoke-MassMimikatz-PsRemoting, which combines SPN discovery, PowerShell Remoting, and Invoke-Mimikatz to harvest credentials from many domain systems automatically.

Any domain user can query AD SPN records to enumerate every SQL Server—instances and ports included—without noisy scans; NetSPI's Get-SQLServerAccess module then tests each for accessible logins.

A Kerberoasting remediation guide: check whether an SPN is still in use via Event ID 4769, then remove unneeded SPNs with setspn or ADUC. Also covers the impact of deleting actively used SPNs.