Kerberos and NTLM hardening
Reducing NTLM, tightening Kerberos encryption types, and finding what still depends on legacy auth.
DRAFT OUTLINE. This page is a structure to fill in, not finished research.
# Lab environment
- A small home Active Directory lab (details kept general on purpose)
- [TBD: generic lab summary for this write-up: no host names, IPs or domain names]
# Auditing NTLM first
- Turning on NTLM auditing before blocking anything
- [TBD: what showed up in your lab logs]
# Restricting NTLM
- Staged approach: audit, allow-list, deny
- [TBD: settings you used]
# Kerberos encryption types
- Removing RC4 / DES where possible
- Service accounts and AES keys
- [TBD: results]
# Kerberoasting exposure
- Finding SPNs on user accounts
- Long random passwords / gMSAs
- [TBD: what you found and fixed]
# Detection notes
- [TBD: event IDs and queries you used]
# References
- [TBD: sources you used]