Back to all recipes
Level: MidLast updated:
Find accounts with an SPN (Kerberoasting targets)
Get-ADUser -Filter {ServicePrincipalName -like "*"} `
-Properties ServicePrincipalName,PasswordLastSet |
Select-Object Name,PasswordLastSet,ServicePrincipalNameWhy it works this way
Every user account with an SPN is a password an attacker can crack offline.
Watch out
- Service account passwords: 25+ characters, or move to gMSA.
- Check PasswordLastSet — ten-year-old passwords are common.