Resource-Based Constrained Delegation, often shortened to RBCD, is a Kerberos delegation model in Active Directory where the target resource controls which accounts are allowed to delegate to it. It was introduced to make delegation easier to manage across service boundaries, but it can create serious security risk when permissions on computer objects are weak or […]
Resource-Based Constrained Delegation in Active Directory Read Post »
Constrained delegation is a Kerberos delegation setting in Active Directory that allows a service to impersonate users only to specific downstream services. It was introduced as a safer alternative to unconstrained delegation because it limits where delegated authentication can be used. The simplest way to think about constrained delegation is: A service can act on
Constrained Delegation in Active Directory Read Post »
Unconstrained delegation is a legacy Kerberos delegation setting in Active Directory that allows a trusted service to impersonate users to other services. It was designed to support multi-tier applications, but it can create serious security risk if the trusted server or service account is compromised. A server trusted for unconstrained delegation may be able to
Unconstrained Delegation in Active Directory Read Post »
AS-REP Roasting is an Active Directory attack technique that targets user accounts configured with Kerberos preauthentication disabled. When preauthentication is not required, an attacker can request Kerberos authentication data for the account and attempt to crack it offline to recover the user’s password. AS-REP Roasting is dangerous because it does not require administrative privileges. In
AS-REP Roasting in Active Directory Read Post »
Kerberoasting is an Active Directory attack technique where an authenticated domain user requests Kerberos service tickets for accounts that have Service Principal Names, then attempts to crack those tickets offline to recover the service account passwords. Kerberoasting is dangerous because it does not require administrative privileges. In many environments, any valid domain user can request
Kerberoasting in Active Directory Read Post »
LDAP signing is a security control that helps protect communication between LDAP clients and Active Directory domain controllers. It helps ensure that LDAP traffic has not been tampered with in transit and reduces exposure to certain man-in-the-middle and relay-style attacks. In many Active Directory environments, LDAP is used constantly. Applications, servers, workstations, network appliances, and
LDAP Signing and Why It Matters Read Post »