gMSA SPN Hygiene
Group Managed Service Accounts and SPN hygiene — reduce Kerberoast surface on $LAB_AD with strong managed passwords and SPN audit.
Visual · t25_gmsa_spn_hygiene
gMSA + SPN hygiene = service account hardening. $LAB_AD literacy. Original Cyberlium.
Kerberoasting hunts weak service passwords — gMSA and SPN hygiene starve the hunt on your lab forest.
gMSA (Group Managed Service Account) literacy: Windows manages password rotation for service accounts in authorized groups — reduces long-lived weak passwords targeted by Kerberoasting (Module 5 named). SPN hygiene: register SPNs only where needed, remove stale SPNs, prefer gMSA/sMSA over user accounts with SPNs, use long random passwords if gMSA unavailable, restrict who can read service account passwords. Defenders: audit SPNs (setspn -Q), monitor 4769 for anomalous TGS requests, enforce AES for Kerberos. Cyberlium applies hygiene checklist to YOUR $LAB_AD service accounts — NOT Kerberoast cookbooks on stranger domains, NOT cracking real enterprise SPN lists from leaks. Lab row: one misconfigured SPN account on lab with gMSA migration recommendation.
1. gMSA benefits
Automatic password management, constrained delegation support, reduced Kerberoast ROI.
Requires Windows Server 2012+ domain functional level literacy — note lab version.
Command guide
Try these commands — gMSA benefits
═══ WINDOWS / POWERSHELL (Lab DC or Joined Machine) ═══
Enumerate user accounts that have a Service Principal Name (SPN) configured
Command — copy this
Get-ADUser -Filter {ServicePrincipalName -like "*"} -Properties ServicePrincipalName | Select-Object SamAccountName, ServicePrincipalNameRequest a TGS ticket for an SPN on your lab domain (Defender testing)
Command — copy this
Add-Type -AssemblyName System.IdentityModel New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "HTTP/webserver.lab.local"
View cached Kerberos tickets (look for ticket encryption: RC4 vs AES)
Command — copy this
klist
═══ DEFENDER AUDITING ═══ Monitor Event ID 4769 in Windows Security Log for TGS requests (Ticket Encryption 0x17 = RC4)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4769} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-List TimeCreated, MessagePrimary tools to practice this lesson: curl, grep. Reference sites: Microsoft gMSA (https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-managed-service-accounts/group-managed-service-accounts-overview); Kerberoast mitigation (https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769); adsecurity.org (https://adsecurity.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. SPN audit checklist
List SPN accounts on $LAB_AD, flag user accounts with SPNs, plan gMSA or strong password.
Remove duplicate and orphaned SPNs — defender ticket, not roast target list export.
3. Refused
No Kerberoast tool output from stranger AD as homework evidence.
Hygiene output is remediation plan — not cracked TGS hashes published.
4. What you ship: gMSA SPN hygiene checklist
gMSA definition + six SPN audit steps + one lab misconfig fix row.
5. What you record before the next lesson
gMSA SPN hygiene checklist path.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Kerberoast stranger domain SPNs and submit hash list for credit.
- Right: gMSA SPN hygiene checklist on $LAB_AD. Next: LSA Credential Guard.
Mission: gMSA SPN hygiene checklist
1) Define gMSA one line. 2) Write six SPN audit steps. 3) One lab misconfig + fix. 4) NEVER stranger Kerberoast homework.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “User account with SPN — migrate path?”
APPLY: gMSA helps reduce:
APPLY: True or False: Kerberoast stranger AD for hygiene lab credit.
APPLY: SPN hygiene includes:
LSA Credential Guard
Part of Active Directory Attacks — Defense and Hardening.
Lab — Defense
Part of Active Directory Attacks — Defense and Hardening.
Quiz — Defense
Part of Active Directory Attacks — Defense and Hardening.