Find Kerberoastable Service Accounts and Move Them to gMSA

Why this lab matters

When a client asks for a service ticket, part of the ticket is encrypted with a key derived from the service account's password. Any authenticated user may ask for that ticket. If the password is short or old, an attacker can crack it offline with no failed logons and no lockout. Service accounts set up years ago with a memorable password and Domain Admin rights are exactly what attackers look for.

What you need

• A lab domain with one domain controller and one member server, at Windows Server 2012 domain functional level or later.
• The Active Directory PowerShell module and Domain Admin rights in the lab.
• Test data: create a user svc-legacyapp and give it an SPN with setspn -S HTTP/legacyapp.corp.example svc-legacyapp.

Step 1: Find every user account with an SPN

Import-Module ActiveDirectory

$svc = Get-ADUser -Filter 'ServicePrincipalName -like "*"' -Properties ServicePrincipalName,
         PasswordLastSet, LastLogonTimestamp, adminCount, 'msDS-SupportedEncryptionTypes', MemberOf, Enabled |
  Where-Object SamAccountName -ne 'krbtgt' |
  Select-Object SamAccountName, Enabled, PasswordLastSet,
    @{n='PwdAgeDays';e={ [int]((Get-Date) - $_.PasswordLastSet).TotalDays }},
    @{n='LastLogon';e={ [datetime]::FromFileTime($_.LastLogonTimestamp) }},
    @{n='Privileged';e={ $_.adminCount -eq 1 }},
    @{n='EncTypes';e={ $_.'msDS-SupportedEncryptionTypes' }},
    @{n='SPNs';e={ $_.ServicePrincipalName -join '; ' }}

$svc | Sort-Object PwdAgeDays -Descending | Format-Table SamAccountName, PwdAgeDays, Privileged, EncTypes -AutoSize
$svc | Export-Csv .\spn-accounts.csv -NoTypeInformation

Step 2: Rank the risk

Signal	How to read it
PwdAgeDays over 365	The password predates current standards and has had years to leak
Privileged is True	Cracking it gives admin rights. Fix these first
EncTypes empty or includes 4	RC4 is allowed, which is much faster to crack. A value of 24 means AES only
No recent logon	The service may be retired. Remove the SPN or disable the account

For accounts you cannot migrate yet, set a random password of 25 characters or more and enforce AES:

Set-ADUser svc-legacyapp -Replace @{ 'msDS-SupportedEncryptionTypes' = 24 }
# then change the password so new AES keys are generated

Step 3: Prepare for gMSA

1. Create the KDS root key, once per forest. In production it becomes usable after 10 hours so that all domain controllers receive it:

   Add-KdsRootKey -EffectiveImmediately

   For a single domain controller lab only, you can backdate it so it works straight away:

   Add-KdsRootKey -EffectiveTime ((Get-Date).AddHours(-10))

2. Create a group for the servers allowed to use the account, add the member server and restart that server so it picks up the membership:

   New-ADGroup -Name 'GRP-gMSA-LegacyApp' -GroupScope Global -GroupCategory Security
   Add-ADGroupMember 'GRP-gMSA-LegacyApp' -Members 'APP01$'

Step 4: Create and install the gMSA

New-ADServiceAccount -Name 'gmsa-legacyapp' `
  -DNSHostName 'gmsa-legacyapp.corp.example' `
  -PrincipalsAllowedToRetrieveManagedPassword 'GRP-gMSA-LegacyApp' `
  -KerberosEncryptionType AES128, AES256

On the member server:

Install-WindowsFeature RSAT-AD-PowerShell
Install-ADServiceAccount -Identity 'gmsa-legacyapp'
Test-ADServiceAccount -Identity 'gmsa-legacyapp'   # must return True

Step 5: Switch the service over

1. Give the gMSA the same file, database and local rights the old account had. Do not add it to an admin group to save time.
2. Open services.msc, open the service, and on the Log On tab enter CORP\gmsa-legacyapp$ with the password boxes left empty.
3. Move the SPN to the new account:

   setspn -D HTTP/legacyapp.corp.example svc-legacyapp
   setspn -S HTTP/legacyapp.corp.example gmsa-legacyapp$

4. Restart the service and test the application. Then disable the old account, and delete it after an agreed waiting period.

Step 6: Detect roasting

On domain controllers, turn on Audit Kerberos Service Ticket Operations for success. Then look for ticket requests that use RC4:

Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4769 } -MaxEvents 2000 |
  Where-Object { $_.Properties[5].Value -eq 0x17 -and $_.Properties[2].Value -notlike '*$' } |
  Select-Object TimeCreated, @{n='User';e={$_.Properties[0].Value}}, @{n='Service';e={$_.Properties[2].Value}}

One user requesting RC4 tickets for many different services in a few minutes deserves a closer look.

Evidence to keep

• The SPN account export before and after.
• The gMSA properties, including which group can retrieve the password.
• A screenshot of the service running under the gMSA.