Search Results

How exactly would that session key be kept in sync between the KDC and the target service? The KDC encrypts the ticket to a key the server knows. That therefore means both the KDC and the target serve …

The ticket itself is sent in plaintext in the REP. KDC-REP ::= SEQUENCE { pvno [0] INTEGER (5), msg-type [1] INTEGER (11 -- AS -- | 13 -- TGS --), pad …

No, it's not. The client prompts for the password using a thing called Cred UI, which passes it off the to Windows security stack called LSA. LSA converts the password into a Kerberos key and attempts …

When you do a PKINIT authentication to the KDC an additional field is included in the krbtgt response in the PAC called PAC_CREDENTIAL_INFO. This includes supplemental credentials for your logon such …

What is the motivation for administrators to launch services with SPN from domain user accounts? There are five ways you can set these things up: Local service on a workgroup machine Local user on …

RDP uses a protocol called CredSSP to delegate credentials. The process works like this. MSTSC prompts for credentials (or uses saved creds) MSTSC requests a network logon ticket (Kerberos or NTLM) …

In short: no, unconstrained delegation is not more secure than constrained delegation (that does not necessarily prove the inverse either, but that's a different conversation). You're conflating S4U2 …

Disclosure: I work on the team that builds WHfB. Windows Hello for Business is only one vertical for reducing credential theft and lateral movement. There's no one-size-fits-all solution for this pro …

A service ticket is a very specific thing. Active Directory will only let you request service tickets to principals that have SPNs registered because otherwise it's not a service principal as far as K …

You would have to ban RC4 entirely to be protected. This is possible and it would prevent an attacker from requesting a TGT with an RC4 request. This is a global setting you apply to DCs. One thing to …

Specifically it's intended for User accounts that are used as service accounts, instead of using a computer account.

So, this whole reasoning is kind of insane. Auditing password correctness after the fact is a bad idea (because you either need the original password, or a weak hash that can effectively be rainbow-ta …

HRD is done through two different mechanisms, which are used in either passive or active contexts. The passive method will determine the realm based on the username after they've lost focus of the use …

AFAIK the token is never destroyed as the session is still present, but that doesn't mean the token doesn't get stale. The token gets refreshed on an unlock.

My understanding is that the wipe is unrelated to the user account, as the phone itself is now tied to Exchange.