sysop@hub:~/explainers/war-stories/kerberoast-service-account$
The service account nobody remembered
A five-year-old service account with a never-expiring password became the quiet path from a regular user account to Domain Admin.
timeline
During a routine review, a junior admin runs a script that lists every account with a Service Principal Name in the domain and finds 40 of them, most undocumented.
As a test, she requests a Kerberos service ticket for one of the oldest SPN accounts, a reporting service nobody currently recognizes the purpose of. This is a completely ordinary, unprivileged action any domain user can perform.
She takes the ticket offline and runs it against a password cracking tool overnight. The account's password, unchanged since it was created five years earlier, is cracked before morning: a short word plus a two-digit year.
Checking the account's group memberships, she finds it is a member of a group that was granted local administrator rights on every file server in the domain, added years ago for a migration project and never removed.
She reports the finding instead of going further. The account's real owner, a departed contractor's old reporting tool, is identified through old change tickets.
The account is migrated to a Group Managed Service Account with an automatically rotated password, and its unnecessary local admin group membership is removed.
- The account had been created for a single migration project years earlier and was never cleaned up afterward, a common pattern for service accounts.
- Its password had never been forced to rotate, because service accounts are frequently excluded from password expiry policies to avoid breaking whatever depends on them.
- No one was monitoring Kerberos service ticket requests for unusual patterns, so a real attacker doing the same thing would not have been noticed either.
- Move service accounts to Group Managed Service Accounts (gMSA), whose passwords are long, random and rotated automatically with no human ever knowing them. See how Kerberoasting works
- Where gMSA is not possible, use passwords of 25+ characters and rotate them on a schedule, even for accounts that never expire by policy. Glossary: gMSA
- Review which accounts hold Service Principal Names at least twice a year and document why each one exists. Entra ID roles reference
- Watch for event 4769 (Kerberos service ticket requests) with RC4 encryption or unusual volume from a single account, which can indicate this technique in progress. Event 4769 reference
This is a composite scenario built from common, publicly documented attack patterns. It does not describe a specific real organization or incident.