AD-USER-07 - No pre-authentication user count should be retrievable

Contributed by Michael SouleAll contributors →

Overview

Accounts that do not require Kerberos pre-authentication are directly exposed to AS-REP roasting. Attackers can request offline-crackable material without first proving knowledge of the password.

Control Type

Detective

Security Recommendation

Require pre-authentication for all accounts unless there is a justified exception. Review and remove legacy settings that disable this protection.

How the Test Works

This test retrieves Active Directory user data from Get-MtADDomainState and counts users where DoesNotRequirePreAuth = $true or the corresponding userAccountControl bit is set.

Related Tests

• Test-MtAdUserDelegationAllowedCount
• Test-MtAdUserKerberosDesOnlyCount
• Test-MtAdUserPasswordNotRequiredCount

Related links

• Microsoft Defender for Identity: Unsecure account attributes
• ANSSI Active Directory checkpoints: Kerberos preauthentication disabled

Test Metadata

Field	Value
Test ID	AD-USER-07
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Users
Area	Authentication
Resource type	User
MITRE ATT&CK	T1558.004 AS-REP Roasting
PowerShell test	Test-MtAdUserNoPreAuthCount
Services	ActiveDirectory

Source

• Test: tests/ad/user/Test.AD-USER-07.ps1
• Documentation: tests/ad/user/Test.AD-USER-07.md