TL;DR Kerberoasting is fundamentally a weak password problem. Stronger encryption slows down cracking, but it doesn’t eliminate the risk. If the password is weak, AES won’t save you. There’s no new, groundbreaking tradecraft here. Clients often ask us whether Kerberoastable user accounts (i.e., user accounts with a Service Principal Name [SPN]) remain at risk if […]