ADPRIV-014: Privileged Users DES-Only Kerberos
- Platform
- Active Directory
- Category
- AD Privileged Account Security
- Severity
- High
- Zero Trust pillar
- Identity (weight 2)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
The check issues an LDAP query for (&(objectCategory=person)(objectClass=user)(adminCount=1)(userAccountControl:1.2.840.113556.1.4.803:=2097152)) against the default naming context and pulls userAccountControl, msDS-SupportedEncryptionTypes, memberOf, adminCount, pwdLastSet, and servicePrincipalName for each result. The 1.2.840.113556.1.4.803 matching rule is LDAP_MATCHING_RULE_BIT_AND, which selects only objects where the USE_DES_KEY_ONLY bit (0x200000) is set in userAccountControl. The check also normalizes the result set against the canonical Tier 0 group enumeration (Domain Admins, Enterprise Admins, Schema Admins, BUILTIN\Administrators, Account Operators, Backup Operators, Print Operators, Server Operators, Group Policy Creator Owners, krbtgt and any account holding SeDebugPrivilege or SeBackupPrivilege via direct or nested membership) so that recently SDProp-protected accounts are surfaced even when adminCount has not yet been written. For every flagged account the check additionally interprets msDS-SupportedEncryptionTypes per [MS-KILE] section 2.2.7 to confirm whether AES bits (0x08 AES128, 0x10 AES256) are present; an account with USE_DES_KEY_ONLY set and no AES bits is the worst case because the KDC will refuse to issue anything stronger than DES for that principal.
Why it matters
DES has been formally withdrawn by NIST since 2005 (FIPS 46-3 withdrawal) and is no longer considered fit for any production use. The DES-CBC-MD5 (etype 3) and DES-CBC-CRC (etype 1) Kerberos ciphers use a 56-bit effective key, which can be exhausted in roughly a day on a single modern GPU and in minutes on dedicated FPGA or cloud-scale resources. When a privileged account carries the USE_DES_KEY_ONLY flag, every Kerberos exchange touching that account, including AS-REQ pre-authentication blobs and any TGS-REP issued for an SPN registered against it, is encrypted with a DES-derived key. An attacker who captures a single AS-REP (via ASREPRoasting if pre-authentication is also disabled) or a single TGS-REP (via Kerberoasting if the account holds an SPN) can recover the long-term password offline in trivial time, with no online interaction beyond the initial ticket request. Because the account is in Tier 0 by virtue of adminCount = 1, the recovered credential typically yields Domain Admin or equivalent. The flag also signals long-running operational neglect: USE_DES_KEY_ONLY was deprecated by Microsoft in Windows 7 and Windows Server 2008 R2 when DES was disabled by default at the policy layer, so its presence on a privileged account in a current environment indicates either a never-cleaned migration artifact from a pre-2008 deployment or a deliberate downgrade to interoperate with a legacy peer that should have been retired.
Attack path
Step 1: Discovery. The attacker, holding any authenticated domain user context, enumerates privileged accounts with weak encryption. ldapsearch or PowerView Get-DomainUser -AdminCount -UACFilter USE_DES_KEY_ONLY returns the candidate set in one query, as does Rubeus kerberoast /stats with the etype column. Step 2: Ticket acquisition. If the account holds a servicePrincipalName, the attacker requests a TGS-REP for any registered SPN. Rubeus kerberoast /user:svc_legacy /nowrap or GetUserSPNs.py -dc-ip <dc> contoso.local/lowpriv returns a $krb5tgs$3$* blob (etype 3, DES-CBC-MD5) or $krb5tgs$1$* (etype 1, DES-CBC-CRC). If pre-authentication is disabled on the account (the DONT_REQ_PREAUTH bit, often paired with DES on legacy service accounts), GetNPUsers.py returns an AS-REP encrypted with the same DES key without requiring any prior credential. Step 3: Offline cracking. The attacker runs hashcat against the captured material. Mode 19600 covers Kerberos 5 TGS-REP etype 3 and mode 19500 covers AS-REP etype 23, with DES variants supported via Kerberos-aware john the ripper plug-ins. Brute force of a 56-bit DES key completes in under 24 hours on a single RTX 4090 even without a wordlist, because the search space is bounded by the key length itself rather than by password entropy. Where the password is short or weak, dictionary attack with rules recovers the cleartext in seconds. Step 4: Credential use. The recovered cleartext or NT hash is used to authenticate as the privileged account via Pass-the-Hash (over SMB or WinRM) or to request a TGT with the cleartext via kinit. Because adminCount = 1, the account has Tier 0 reach: Domain Admin operations, DCSync via the Replicating Directory Changes extended right, or silver-ticket forgery against any service the account fronts. Step 5: Persistence. If the compromised account is krbtgt itself (rare but historically observed in heavily customized legacy domains where the krbtgt UseDESKeyOnly bit was manually set), the attacker forges golden tickets directly. Otherwise the recovered identity is used to reset the krbtgt password under cover of legitimate administrative activity, or to add a backdoor delegation that survives short-term remediation.
How Guerrilla assesses it
Guerrilla binds to the closest writable domain controller over LDAP (port 389, or 636 when LDAPS is mandated) and issues a paged search against the default naming context with filter (&(objectCategory=person)(objectClass=user)(adminCount=1)(userAccountControl:1.2.840.113556.1.4.803:=2097152)) and attribute list userAccountControl, msDS-SupportedEncryptionTypes, memberOf, pwdLastSet, lastLogonTimestamp, servicePrincipalName, adminCount. The bit-AND matching rule isolates accounts where USE_DES_KEY_ONLY (0x200000) is set in userAccountControl without enumerating the full Tier 0 population. The check then walks the canonical Tier 0 group membership via tokenGroups expansion on each candidate to confirm effective privilege, since adminCount can lag SDProp by up to one hour after a group change. For every confirmed account the check decodes msDS-SupportedEncryptionTypes into a human-readable etype list and computes the worst-case ticket cipher the KDC will issue. The output enriches each finding with the account distinguishedName, the path of Tier 0 group membership, the SPN list (Kerberoasting attack surface indicator), pwdLastSet (age of the recoverable secret), and the corresponding userAccountControl decoded flag string so the operator can confirm whether DONT_REQ_PREAUTH is also set (ASREPRoasting compounding factor).
Recommended value
No accounts with 'Use Kerberos DES encryption types for this account' flag set
Remediation
Identify accounts using Get-ADUser -Filter {UseDESKeyOnly -eq $true -and AdminCount -eq 1}. Clear the DES-only flag and ensure accounts support AES256 encryption. Rotate passwords on affected accounts to generate new AES-based Kerberos keys
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- SC-12, SC-13
- ANSSI
- R36
- CIS AD Benchmark
- 4.3.5
- MITRE ATT&CK
- T1558, T1078.002