Service accounts and passwords that never expire
You inventory the service accounts, find the accounts with SPNs and their Kerberoasting exposure, and the accounts whose password never expires, isn’t required or that skip pre-authentication using userAccountControl bits, turn password age into a date, and at the end list the risky accounts (different in every lab) yourself and report them with advice.
Level 201 · 45 min
An application (a database, a web site, backup software) runs in the domain under an identity: a service account. These are more dangerous than people’s accounts: they often have strong rights, their passwords don’t change for years, and since nobody logs on with them, misuse goes unnoticed.
When an SPN (Service Principal Name, a "this account runs that service" label) is added to an account, any user in the domain can ask for a ticket to that service. The ticket is encrypted with a key derived from the account’s password. If the password is weak, an attacker can take the ticket and try to crack it by guessing on their own computer: this is called Kerberoasting. The defender’s job is to find the accounts carrying this risk and close it: a long random password or a managed service account (gMSA).
There is less help in this section: the first two steps are ready, then you type by hand, and in the last three steps you only see the goal. Some accounts are picked at random in every lab; you can’t take the answers from someone else.
What you will do in this lesson
- The service account inventory
- Accounts with SPNs
- Passwords that never expire: UAC bit 65536
- The password’s age: pwdLastSet
- An account that needs no password: bit 32
- Accounts without pre-authentication: bit 4194304
- The list of accounts exposed to Kerberoasting
- Enabled accounts whose password never expires
- The service account report
- Short quiz
Skills you will earn
- Taking an inventory of service accounts
- Auditing accounts with SPNs exposed to Kerberoasting
- Filtering userAccountControl bits with the 803/804 rules
- Finding enabled accounts whose password never expires
- Converting Windows FILETIME values to dates
- Finding accounts that need no password (UAC 32)
- Finding accounts without Kerberos pre-authentication
- Reporting service account risks with advice (gMSA)
← Finding unused and disabled accounts · Active Directory security: auditing and hardening · Password policy and fine-grained password policies (FGPP) →
Start for free