Chapter 3 — Harden

Closing the Kerberoast Gap

Applying targeted Tier-0 hygiene against the exact attack path used in Chapter 2: gMSA migration, AES-only Kerberos, password complexity, audit policy, and verifying the next attack iteration fails.

Previous Chapter See All Chapters Next Chapter

Hardening Plan

Each control here ties back to a specific finding from Chapter 2. The goal is not to fix everything in Active Directory — it is to close this attack path and prove the closure.

Control 1gMSA migration
Control 2AES-only Kerberos
Control 3Strong password policy
Control 44769 detection rule

Screenshots

Drop screenshots into img/homelab/ch3/ with the filenames referenced below and they will appear here. Until then, placeholder tiles render in their place.

01 — gMSA Created
Group Managed Service Account

New-ADServiceAccount with auto-rotated 240-character password.
02 — AES-only
AES encryption enforced

msDS-SupportedEncryptionTypes set to 24 (AES128 + AES256) on service accounts.
03 — Password Policy
Fine-grained password policy

PSO applied to service accounts: 25 char minimum, complexity required, no reversible encryption.
04 — Deprivilege
Group membership cleaned

Service account removed from nested admin groups, scoped to the rights it actually needs.
05 — 4769 Audit
Detection rule

Audit Kerberos Service Ticket Operations enabled; rule alerts on RC4 ticket requests + volume thresholds.
06 — Retest Fails
Attack retry blocked

Re-running the Chapter 2 attack: ticket comes back AES-only and the hash refuses to crack within wordlist scope.

Findings

Results from running the same Chapter 2 attack against the hardened environment.

  • Hash is now AES-encryptedThe TGS still returns to any authenticated user, but the encryption type is now AES256 (etype 18), which dramatically raises the cost of offline cracking.
  • Password is no longer in any wordlistThe gMSA auto-generated password (240 characters, fully random) is computationally infeasible to brute-force with consumer hardware.
  • Detection firesThe 4769 audit rule generated a high-confidence alert as soon as the attacker requested the service ticket — defender-side visibility is now present.
  • Blast radius reducedEven if the credential were somehow recovered, the cleaned group membership means it no longer leads to Domain Admin.
  • Open follow-upsRC4 is disabled at the account level but not yet domain-wide; LAPS for local admin accounts and Tier-0 separation still pending — queued for future chapters.