With Kerberoast, attackers exploit the internals of the Kerberos authentication protocol and generally target privileged domain user accounts. The goal of this attack is to discover the cleartext password of a privileged account, and thereby gain the associated rights. This attack can be performed from inside an Active Directory environment. All an attacker needs is a simple, unprivileged user account.

When the Service Principal Name attribute is set on an account, the underlying security of this account is further affected. Usually, password security policies are configured to lock an account after a few password failures in a row.
However, when this attribute is set, exhaustive password guessing is feasible.

Privileged accounts such as those in the Domain Admins group are usually targeted in Kerberoasting. Getting access to these accounts can lead to a full domain compromise.

By default, this check skips privileged disabled accounts. To also check privileged disabled accounts, please enable thorough tests.

Note: The AD Starter Scan and associated plugins are intended to be used with smaller AD deployments for purposes of preliminary analysis. Accurate preliminary analysis can be expected for AD deployments with up to 5000 users, groups or machines and incomplete results will be returned for larger AD deployments with Nessus, Security Center and Vulnerability Management. For more information on the issues discovered by the Active Directory Starter Scan plugins, please refer to this blog post - https://www.tenable.com/blog/new-in-nessus-find-and-fix-these-10-active-directory-misconfigurations

Active Directory uses the Kerberos protocol for authentication. As it is an old protocol, numerous security hardening measures have been taken since its creation, and some legacy options must be disabled to ensure proper security posture.

An attacker can use the AS-REP Roasting attack to guess the users' passwords. The first part of the AS-REP Roasting attack is to identify users for whom the Kerberos pre-authentication is not set (DONT_REQ_PREAUTH). This is part of the userAccountControl attribute.

Without Kerberos pre-authentication, an attacker can send an authentication request (AS-REQ) to the KDC on behalf of the user. The KDC will then reply with an encrypted TGT (AS-REP). A part of the AS-REP is encrypted with the original user's key, derived from their own password. The attacker can then use offline bruteforcing to guess the password. This attack is much faster than online bruteforcing (e.g. by making numerous authentication requests with different passwords).

Pre-authentication forces the attacker to be in possession of the password (by having to encrypt a timestamp) before the KDC sends back the encrypted TGT.

By default, this check skips disabled accounts. To also check disabled accounts, please enable thorough tests.

Note: The AD Starter Scan and associated plugins are intended to be used with smaller AD deployments for purposes of preliminary analysis. Accurate preliminary analysis can be expected for AD deployments with up to 5000 users, groups or machines and incomplete results will be returned for larger AD deployments with Nessus, Security Center and Vulnerability Management. For more information on the issues discovered by the Active Directory Starter Scan plugins, please refer to this blog post - https://www.tenable.com/blog/new-in-nessus-find-and-fix-these-10-active-directory-misconfigurations

Kerberos, the protocol at the core of Active Directory security, allows certain servers to obtain a user's credentials and use those to authenticate on behalf of the user.

When a user authenticates on a server that is Trusted for delegation, a copy of the user's credentials is sent to the server by the domain controller. These credentials can then be used to authenticate on behalf of the user.

If an attacker is able to compromise such a server, they will be able to steal and reuse the credentials of all the users authenticating on this particular server. If an administrator connects to the compromised machine, the attacker will be able to escalate their privileges and become an administrator as well. As a consequence, the Trusted for delegation property should only be allowed on trusted servers such as domain controllers. This mechanism is called unconstrained delegation.

Note: The AD Starter Scan and associated plugins are intended to be used with smaller AD deployments for purposes of preliminary analysis. Accurate preliminary analysis can be expected for AD deployments with up to 5000 users, groups or machines and incomplete results will be returned for larger AD deployments with Nessus, Security Center and Vulnerability Management. For more information on the issues discovered by the Active Directory Starter Scan plugins, please refer to this blog post - https://www.tenable.com/blog/new-in-nessus-find-and-fix-these-10-active-directory-misconfigurations

Groups are the standard way of providing access to resources in an environment. Therefore group membership should be treated with utmost care. A less known Active Directory feature can be used for the same purpose: Primary Group ID. This is a mechanism that was created to support legacy UNIX applications, where group membership is not stored in the same way as in Windows. When checking the access rights to a resource, being a member of a group or having a Primary Group ID set for this group is exactly the same from an Active Directory perspective. Not all third party tools and software consider this use-case.

Using the Primary Group ID mechanism is considered a bad practice and a security risk.

Note: The AD Starter Scan and associated plugins are intended to be used with smaller AD deployments for purposes of preliminary analysis. Accurate preliminary analysis can be expected for AD deployments with up to 5000 users, groups or machines and incomplete results will be returned for larger AD deployments with Nessus, Security Center and Vulnerability Management. For more information on the issues discovered by the Active Directory Starter Scan plugins, please refer to this blog post - https://www.tenable.com/blog/new-in-nessus-find-and-fix-these-10-active-directory-misconfigurations

Active Directory uses the Kerberos protocol for authentication. As it is an old protocol, numerous security hardening measures have been taken since its creation, and some legacy options must be disabled to ensure proper security posture.

The original specifications of the Kerberos 5 network authentication protocol [RFC1510] support only DES for encryption.
For many years now, the cryptographic community has regarded DES as insecure, mostly because of its small key size. As a result, DES is now a deprecated and unsafe cryptographic cipher. Even though it can be used by Kerberos in Active Directory, it should be disabled.

By default, this check skips disabled accounts. To also check disabled accounts, please enable thorough tests.

Note: The AD Starter Scan and associated plugins are intended to be used with smaller AD deployments for purposes of preliminary analysis. Accurate preliminary analysis can be expected for AD deployments with up to 5000 users, groups or machines and incomplete results will be returned for larger AD deployments with Nessus, Security Center and Vulnerability Management. For more information on the issues discovered by the Active Directory Starter Scan plugins, please refer to this blog post - https://www.tenable.com/blog/new-in-nessus-find-and-fix-these-10-active-directory-misconfigurations

Active Directory accounts can be configured to escape global password renewal policies. Accounts set up like this can be used indefinitely without ever changing their password. User and administrator accounts should never have this attribute set.

By default, this check skips disabled accounts. To also check disabled accounts, please enable thorough tests.

Note: This plugin is part of the Active Directory Starter Scan Template and is meant to be used for preliminary analysis of AD hosts. For more information on the issues discovered by the Active Directory Starter Scan plugins, please refer to this blog post - https://www.tenable.com/blog/new-in-nessus-find-and-fix-these-10-active-directory-misconfigurations

A blank password can be specified for an account with the PASSWD_NOTREQD option. This option is set through the account's UserAccountControl attribute. This is possible during account creation or when the password is reset by an administrator.

The 'User must change password at next logon' option is not affected by this issue, as it validates that when the user connects and changes his password, the password cannot be empty.

An account without a password is a highly vulnerable one. This allows an attacker to get full access to the resources of the account.

By default, this check skips disabled accounts. To also check disabled accounts, please enable thorough tests.

Note: The AD Starter Scan and associated plugins are intended to be used with smaller AD deployments for purposes of preliminary analysis. Accurate preliminary analysis can be expected for AD deployments with up to 5000 users, groups or machines and incomplete results will be returned for larger AD deployments with Nessus, Security Center and Vulnerability Management. For more information on the issues discovered by the Active Directory Starter Scan plugins, please refer to this blog post - https://www.tenable.com/blog/new-in-nessus-find-and-fix-these-10-active-directory-misconfigurations

ID	Name	Product	Family	Published	Updated	Severity
150480	AD Starter Scan - Kerberoasting	Nessus	Windows	7/29/2021	7/17/2026	high
150482	AD Starter Scan - Kerberos Pre-authentication Validation	Nessus	Windows	7/29/2021	7/17/2026	medium
150485	AD Starter Scan - Unconstrained delegation	Nessus	Windows	7/29/2021	7/17/2026	high
150487	AD Starter Scan - Primary Group ID integrity	Nessus	Windows	7/29/2021	7/17/2026	high
150481	AD Starter Scan - Weak Kerberos encryption	Nessus	Windows	7/29/2021	7/17/2026	medium
150483	AD Starter Scan - Non-Expiring Account Password	Nessus	Windows	7/29/2021	7/17/2026	medium
150489	AD Starter Scan - Blank passwords	Nessus	Windows	7/29/2021	7/17/2026	medium

Detections

Analytics

Plugins Search

high

medium

high

high

medium

medium

medium