#kerberos

Kerberoasting: Turning One Domain Account into a Pile of Service Passwords

Any authenticated user in an Active Directory domain can ask for tickets that are effectively offline password hashes for service accounts. Here is how Kerberoasting works, why it is so reliable, and how to shut it down.