Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Reduce Kerberos ticket abuse in stages: inventory SPN-bearing and privileged accounts, find RC4 dependencies, move compatible systems to AES, apply restrictive controls only to accounts that can meet their prerequisites, and monitor ticket requests on domain controllers. Kerberoasting, stolen-ticket use, and forged-ticket attacks are related but different problems, so no single setting blocks them all.
What Kerberos ticket abuse looks like
Kerberoasting abuses the normal process used to request Kerberos service tickets. An attacker who can authenticate to the domain may request a ticket for a service principal name (SPN), capture the ticket material, and try to crack the associated service-account secret offline. The attack does not require the attacker to log on interactively as the service account. Stronger encryption and better service-account hygiene make cracking harder, but changing encryption types alone does not eliminate every route to ticket abuse.
Stolen-ticket and forged-ticket activity is a different class of problem. A stolen ticket may be replayed while it remains valid. A forged Golden Ticket is a counterfeit ticket-granting ticket (TGT), normally requiring compromise of the KRBTGT secret or equivalent control of the domain. Controls that reduce RC4 use or protect selected users help limit exposure, but they do not by themselves prove that a forged TGT is impossible or provide a complete recovery procedure after domain compromise.
Use a staged hardening plan
- Inventory and baseline: Find SPN-bearing accounts, service identities, privileged memberships, delegation settings, encryption-type dependencies, and applications that authenticate to domain resources.
- Audit before restricting: Enable or review domain-controller Kerberos auditing and measure the volume and nature of ticket requests.
- Migrate from RC4 deliberately: Confirm AES support, remediate legacy dependencies, then restrict allowed encryption types in a controlled scope.
- Apply targeted account controls: Use Protected Users for selected human accounts and authentication policies or silos where their prerequisites and access rules fit.
- Reduce service-account and delegation risk: Remove unnecessary privilege, narrow logon scope, and replace suitable legacy identities with managed service accounts.
- Monitor outcomes: Correlate ticket events with identities, source devices, target services, encryption types, and time patterns. Investigate alerts rather than treating any one event as proof of compromise.
Inventory accounts, dependencies, and delegation first
Find SPN-bearing service accounts
Start with every account that has one or more SPNs. Record the service name, owning application, host, account type, password-management method, last password change, interactive-logon rights, group memberships, and systems that depend on it. An SPN is not automatically malicious; it is the directory mapping that lets Kerberos locate a service. The risk increases when an SPN is attached to a human account, a broadly privileged identity, or an account whose password is old and difficult to rotate.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Microsoft Defender for Identity can help identify service-account candidates, including accounts with SPNs and a password-never-expires attribute. Treat that classification as a starting point, then confirm it against local naming conventions and application ownership. A discovery tool cannot know that an apparently dormant account is still required by a line-of-business system, so validate dependencies before disabling or changing it.
Map privilege and logon scope
For each service identity, document membership in domain-wide or server-administration groups, local administrator rights, scheduled tasks, Windows services, batch jobs, scripts, and allowed logon locations. Remove memberships that are not required by the application. Restrict interactive and remote-interactive logon where the service does not need it, and disable unused accounts only after confirming that no scheduled job, application pool, connector, or integration still uses them.
Review delegation configuration
Inventory unconstrained, constrained, and resource-based constrained delegation. Unconstrained delegation is especially sensitive: a service configured this way can obtain a service ticket to a back-end service in the name of a user who authenticated to it. That design can expose reusable credentials or tickets if the front-end host is compromised. Do not remove delegation blindly; first identify the application flow, document the exact back-end services required, and test a constrained design where possible.
Record encryption-type dependencies
List domain controllers, member servers, appliances, clients, and applications that may lack AES support or have explicitly configured RC4 or DES behavior. Legacy operating systems and embedded devices are common sources of incompatibility. A clean inventory should connect each dependency to an owner, a remediation plan, and a test system rather than simply labeling it “legacy.”
Audit Kerberos activity on domain controllers
Know the key events
Security event ID 4768 records a request for a TGT. Event ID 4769 records a request for a Kerberos service ticket. Together they provide context for who requested authentication, from which computer, for which service, and with what encryption information is recorded by the operating system. Use them to establish a normal baseline before changing policy.
Ticket events can be extremely numerous on a busy key distribution center (KDC). Size collection, retention, indexing, and alerting deliberately so that high volume does not crowd out other security evidence. A short pilot on representative domain controllers can reveal the normal rate, common service names, and expected automation before you enable broad analytics.
Build useful correlations
Correlate the requesting account, source address and device, target SPN, time of day, encryption type, and whether the request is part of a known application pattern. A burst of service-ticket requests for many unrelated SPNs from one workstation deserves attention, particularly when the source account does not normally administer those services. A single unusual request is an investigative lead, not conclusive proof: backup systems, inventory agents, identity-management jobs, and service discovery can also generate atypical traffic.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Plan collection before enforcement
Decide which domain controllers will provide events, how long raw events will be retained, and which fields are forwarded to the security-monitoring platform. Document expected event volume and exclusions before deployment. If an alert depends on encryption type, preserve that field in the pipeline; dropping it during normalization can make an RC4 investigation inconclusive.
Reduce RC4 exposure without breaking authentication
Understand the Windows change
Microsoft’s RC4 guidance states that updates released on or after November 8, 2022 changed the default Kerberos encryption type to AES-SHA1 for accounts without an explicitly configured type. RC4 can still be used when an account or device lacks AES support or has a dependency that keeps it in use. This behavior is version- and configuration-dependent, so do not assume that every ticket in a mixed environment is already AES.
The same Microsoft material describes a plan to disable RC4 as the default assumed supported type for Active Directory domain controllers by the end of the second quarter of 2026. That is a published plan, not confirmation that every organization or every supported build has completed the transition. Check the current guidance and your installed Windows Server versions before setting a date for your own change.
Audit before you disable
Use 4768 and 4769 data to identify RC4 use and pair each finding with the account, device, service, and application owner. Test authentication from every affected class of client, including service accounts, trusts, non-Windows appliances, and older operating systems. Resolve the dependency or document an explicit exception with an owner and an expiration date.
Recommended Free Tools
Configure allowed encryption types by policy
For the documented Group Policy approach, use Network security: Configure encryption types allowed for Kerberos. The AES-SHA1 selections Microsoft identifies are AES128_HMAC_SHA1 and AES256_HMAC_SHA1. Apply the setting to an appropriate pilot organizational unit or security group rather than the whole domain at once.
- Choose a pilot OU containing representative clients, servers, and service accounts.
- Confirm that each pilot identity has usable AES keys. Password resets may be required to generate current keys after a migration or account change.
- Configure the policy with the AES types required by the tested applications.
- Restart target devices as directed by the policy and operating-system guidance.
- Exercise interactive logon, scheduled tasks, service starts, cross-server access, and any trust or appliance workflow.
- Review authentication failures and ticket events, remediate dependencies, and expand the scope in measured waves.
A domain-controller registry configuration is another option described in Microsoft’s RC4 guidance. Use one control path consistently, document where it is applied, and verify the effective setting on every domain controller. Mixed settings can make troubleshooting appear random when requests are handled by different KDCs.
Account for Windows Server versions
Microsoft states that Windows Server 2025 domain controllers do not issue RC4 TGTs. Legacy devices that still require RC4 may therefore fail to authenticate with Kerberos against those domain controllers. Test those devices before introducing a new domain-controller version or changing policy, and provide a supported replacement or remediation plan rather than weakening the whole domain for one exception.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Use Protected Users for selected human accounts
What membership changes
Protected Users is a targeted security group for high-value human identities, not a general service-account control. Members require AES keys and cannot use NTLM, DES or RC4 Kerberos preauthentication, or Kerberos delegation. Credential-caching behaviors are restricted, and the documented TGT lifetime and renewal limit is 240 minutes (four hours).
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Microsoft’s explicit guidance is: “Never add accounts for services and computers to the Protected Users group.” Service and computer accounts commonly lack the interactive and key-management characteristics needed for these restrictions. Adding them can interrupt applications without delivering the intended protection.
Check prerequisites before adding anyone
- Verify that the account has AES keys and that all relevant domain controllers support the required behavior.
- Check password age and history. A controlled password reset may be needed to create current AES keys.
- List every application, script, VPN, scheduled task, and remote-access path that uses the account.
- Confirm that the account does not require NTLM, delegation, or a TGT longer than four hours.
- Prepare a tested break-glass or alternate administrative path so a policy mistake does not lock out all privileged operators.
Roll out in a pilot
Begin with a small set of administrators whose work patterns are known. Test workstation logon, remote administration, file and database access, automation, and recovery procedures during a complete four-hour window. Expand only after monitoring shows that expected access continues to work. Keep service identities and computer accounts out of this group even when they are considered important.
Use authentication policies and silos for configurable restrictions
What these controls add
Authentication policies and authentication policy silos provide configurable restrictions for user, computer, and managed service accounts. Depending on the policy, you can limit TGT lifetimes, require specified sign-in devices, constrain where initial authentication is allowed, and restrict which service tickets may be issued. They complement Protected Users when you need differentiated rules rather than one fixed group behavior.
Microsoft’s documentation includes a 600-minute value as an example of a ten-hour custom TGT lifetime. It is an example configuration, not a universal recommendation. Choose a lifetime based on the account’s workflow, reauthentication capability, and incident-response needs.
Use audit mode before enforcement
Where supported, start in audit mode. Audit mode records policy failures without changing authentication, allowing you to discover applications and users that would be denied. After owners remediate or formally accept the dependencies, move the policy to enforced mode for a pilot scope. Enforced rules can reject requests, so schedule the change with an accessible administrator path and a rollback plan.
Validate platform prerequisites
Check the domain functional level, claims support, and Kerberos armoring requirements for the exact restrictions you intend to use. A policy that appears correctly configured can still fail to provide the expected result when a prerequisite is missing. Validate effective policy on the relevant domain controllers and test both initial logon and subsequent service-ticket requests.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Harden service accounts and delegation
Prefer managed identities where suitable
A group Managed Service Account (gMSA) can provide automatic password management for compatible services and reduce the manual handling of long-lived secrets. Migration requires application support, correct host authorization, and a tested service configuration. A gMSA does not excuse excessive privilege, broad logon rights, or unsafe delegation; review those properties after migration.
Remove unnecessary privilege
Grant each SPN-bearing identity only the file, database, API, or local rights the application actually needs. Remove stale privileged-group membership, limit where the account can log on, and prohibit interactive use when the service does not require it. Rotate or reset passwords according to the application’s supported process, and retire identities that no longer have an owner or dependency.
Replace unconstrained delegation carefully
For each unconstrained-delegation service, document the users and back-end services that depend on impersonation. Test constrained or resource-based alternatives with the application owner, then monitor for access-denied errors and unexpected ticket requests. Changing delegation can alter authentication flows even when the service itself starts normally, so include end-to-end transactions in the test plan.
Monitor for Kerberoasting, stolen tickets, and forged-ticket indicators
Detect suspicious service-ticket patterns
Use event 4769 to look for unusual concentrations of service-ticket requests, new source systems, requests for many SPNs in a short period, or encryption types inconsistent with the account and device baseline. Defender for Identity documents possible Kerberoasting alerts involving suspicious TGS requests after SPN discovery. Correlate the alert with endpoint activity, account ownership, and approved administrative work before escalating.
Investigate possible forged TGT use separately
Golden Ticket-related detections require a different investigation than a Kerberoasting alert. Compare ticket timing, account and domain identifiers, source systems, and service-access patterns with domain-controller records. A detection is a signal that merits containment and expert analysis; it is not proof on its own that a forged TGT was used.
This guidance does not provide a KRBTGT reset sequence for suspected Golden Ticket compromise. Resetting that secret affects the domain and must follow current Microsoft incident-response procedures, including dependency, timing, and recovery considerations. Consult the current authoritative recovery documentation before performing or publishing such a procedure.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchCompare the controls by scope and trade-off
| Control | Scope | Main benefit | Main operational cost or risk |
|---|---|---|---|
| Restrict RC4 and prefer AES | Devices, accounts, and KDC behavior | Reduces reliance on RC4 and addresses one Kerberoasting exposure path | Legacy dependency failures; version and rollout behavior require verification |
| Protected Users | Selected human accounts | Restricts NTLM, RC4/DES, delegation, credential caching, and TGT renewal | AES prerequisite, four-hour TGT, application compatibility, and lockout risk |
| Authentication policies and silos | User, computer, and service accounts | Configurable sign-in, TGT-lifetime, and ticket-issuance restrictions | Functional-level and claims or armoring prerequisites; enforcement can deny authentication |
| Service-account and delegation review | SPN accounts and services | Lowers privilege and limits impersonation or credential exposure | Requires dependency mapping, ownership, and application testing |
| Kerberos auditing and detections | Domain controllers and security monitoring | Provides visibility into ticket requests and suspicious patterns | Potentially high event volume; alerts need investigation |
A practical rollout checklist
- Export or otherwise document SPN-bearing accounts and their owners.
- Record privileged memberships, interactive-logon rights, delegation settings, and password-management methods.
- Enable or verify 4768 and 4769 auditing on domain controllers and size event collection.
- Identify RC4 use, test AES keys, and remediate or formally track legacy dependencies.
- Pilot AES-only policy settings on representative organizational units.
- Confirm the Windows Server versions of domain controllers and the compatibility of older clients and appliances.
- Pilot Protected Users with selected human administrators only; never include service or computer accounts.
- Use authentication-policy audit mode to discover denied scenarios before enforcement.
- Migrate suitable services to gMSAs, then reassess privilege and delegation.
- Deploy detections that correlate source, identity, SPN, time, and encryption type.
- Document rollback, break-glass access, application owners, and exception expiry dates.
Common failure modes and safer fixes
Authentication fails immediately after an AES-only change
Look for a client, appliance, account, or trust that lacks AES support or has stale keys. Revert only the smallest pilot scope needed to restore service, capture the failing event, remediate the dependency, and retest. Do not re-enable RC4 domain-wide as a first response.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
An administrator is locked out after Protected Users membership
Use the preplanned alternate administrative path, remove or correct the membership under change control, and identify which access path required NTLM, delegation, or a longer TGT lifetime. Re-test the account’s complete workflow before adding it again.
Audit data overwhelms the monitoring platform
Measure event rates by domain controller, retain the raw fields needed for investigation, and tune detections around deviations from a known baseline. Reducing collection so aggressively that 4768 or 4769 context is lost defeats the purpose of the control.
A Kerberoasting alert has no obvious attacker
Check approved discovery, backup, identity, and administrative tools first, then correlate source device, account, SPN list, and timing with endpoint telemetry. Keep the alert as an investigative lead until corroborating evidence is found.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Frequently Asked Questions
Does switching from RC4 to AES stop Kerberoasting?
No. AES reduces reliance on RC4 and can make offline cracking more difficult, but encryption migration alone does not eliminate every Kerberoasting path. Continue to reduce service-account privilege, manage passwords, restrict delegation, and monitor service-ticket requests.
Can service accounts be added to Protected Users?
No. Microsoft explicitly says never to add service or computer accounts to Protected Users. Use service-account hardening, suitable gMSAs, authentication policies, and delegation controls instead.
What do events 4768 and 4769 show?
Event 4768 records a TGT request, while 4769 records a Kerberos service-ticket request. Correlate their identity, source, target-service, timing, and encryption details; high event volume is normal on busy domain controllers.
Should RC4 be disabled across the entire domain immediately?
Do not make a blanket change before auditing dependencies. Pilot the AES policy, test legacy clients and applications, monitor failures, and expand in controlled stages with documented exceptions.
Free tools Windows power users keep installed
One-click scans. No signup required.
Are Protected Users and authentication policies interchangeable?
No. Protected Users is a fixed, targeted control for selected human accounts, including a four-hour TGT limit and restrictions on NTLM, RC4/DES preauthentication, and delegation. Authentication policies and silos provide configurable rules for users, computers, and managed service accounts, with prerequisites and audit modes that must be validated.
The Bottom Line
Kerberos hardening works best as a dependency-led program: discover first, move compatible systems away from RC4, protect only accounts that can meet stricter requirements, reduce service-account and delegation exposure, and use 4768/4769 telemetry to verify the result.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
