Share via

Kerberos authentication vs NTLM

Adol 0 Reputation points
2023-11-19T04:15:04.6933333+00:00

Sometimes, the web site user write "Pass the Hash does not work for Kerberos authentication on Active Directory".

However, in Kerberos authentication, pre-authentication data is sent from the domain controller in ERR-PREAUTH-REQUIRED, and the pre-authentication data is encrypted with a password hash on the client in AS_REQ, and the domain controller also check the data with a password hash.

Considering this, I think that encrypting data from the server using password hash and verifying it on the server is no different from NTLM authentication.

Although there are sites that mention that Pass the Hash cannot be used with Kerberos authentication, I could not find a site that specifically explains why.

If anyone knows the reason for this, please let me know.

Windows for business Windows Client for IT Pros Directory services Active Directory
Windows for business Windows Server Devices and deployment Configure application groups
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vahid Ghafarpour 23,385 Reputation points Volunteer Moderator
    2023-11-19T07:37:29.73+00:00

    Thanks for posting your question in the Microsoft Q&A forum.

    I hope this article can help you:

    https://www.csoonline.com/article/548804/don-t-count-on-kerberos-to-thwart-pass-the-hash-attacks.html

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.