AS-REP roasting
AS-REP roasting is an Active Directory attack against accounts that have Kerberos pre-authentication disabled. The domain controller will return an authentication response containing material encrypted with the account’s password key to anyone who asks for it, and that material is then cracked offline.
Pre-authentication exists to stop exactly this. Normally the client must prove it knows the password before the key distribution centre replies, so an attacker gets nothing without credentials. When the flag that disables it is set, that proof is skipped, and the reply arrives containing a blob encrypted under a key derived from the password. Cracking happens on the attacker’s own hardware, against a wordlist, with nothing further sent to the network.
The precondition that makes it dangerous is what it does not require: no credentials at all, only the account name. That puts it earlier in an intrusion than kerberoasting, which needs a valid domain account first, and it means a list of usernames obtained from a company directory or a naming convention is enough to try it.
The flag is almost never set deliberately. It is set to make a legacy application, an appliance integration or a Unix client work, and it stays set for years. In a report the finding is written against the account and the group memberships that make the recovered password matter, the evidence is the account name and the flag state read from the directory, and the fix is one attribute change rather than a patch. Enumerating these accounts is part of Kerberos review during the internal testing where this is one of the first checks against the directory.