Am looking into mitigations to Pass+the-Hash and Pass-the-Ticket in Active Directory that also improve overall network security, too. Have sorting through some of the many two+factor authentication options to increase security of user login, but just discovered that under the standard AD way of doing things two-factor authentication is still using Kerberos or NTLM. So pass-the-hash or pass-the-ticket attacks are still effective against the domain. The stuff I've read seems to say that only "interactive" logins are not vulnerable to this.

How can I adopt two-factor authentication for AD user logins in ways that won't just be as vulnerable to pass-the-hash/ticket as passwords are? To the extent it matters, I'm referring to environments using Windows Server 2008 R2 and Server 2012.


Matt Weeks, in his Credential Assessment Mapping Privilege Escalation at Scale talk, discusses many techniques to prevent PtH, PtT, and PtK (OPtH).

Starting at 41:50 and up until 48:52, he goes over many prevention angles and gotchas -- https://youtu.be/_XXs8pRnqSQ?t=41m50s

My favorite recommendations are the rotation of KRBTGT weekly, and, if you can utilize smart cards then rotate the user hashes daily. He also speaks about a generic PtH control with blocking inbound NTLM to the domain.

The DFIR Blog has an excellent three-part series on many other detections and mitigations --

  1. http://dfir-blog.com/2015/11/08/protecting-windows-networks-defeating-pass-the-hash/
  2. http://dfir-blog.com/2015/11/24/protecting-windows-networks-dealing-with-credential-theft/
  3. http://dfir-blog.com/2015/12/13/protecting-windows-networks-kerberos-attacks/

As for two-factor authentication and one-time password schemes, I don't think that FIDO (e.g., YubiKey) or a competing system would deter any of the above suggestions -- it would just add to their control strength and provide operational residual risk reduction.


There is no way to use 2FA as a mitigation against p2H (stolen kerberos credentials):

  1. There are 2 types of credentials in Windows AD network: Kerberos tokens/hashes and clear text Logins/Passwords.
  2. Kerberos is a Single factor authentication protocol - it authenticates password hash or PKI certificate but not both. There is NO 2FA method exist to protect stolen Kerberos credentials. (2FA requires user iteractions which contradicts SSO principle - no user iteraction after initial login). You need to implement a security governance program - a set of measures to mitigate PtH.
  3. stolen/compromised Logins/Password are protected by using 2FA methods by MS (OTP only, requires CA) or a bunch of 3rd party that allows to use and combine a variety 2FA means.
  • Hi AleSil, please take a look here
    – bummi
    Jan 9 '19 at 12:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.