KBY Technologies Logo
Active Directory · Windows PowerShell 5.1

AD accounts with Kerberos pre-authentication turned off

Which user accounts don't require Kerberos pre-authentication (DONT_REQ_PREAUTH)?

Script

#Requires -Modules ActiveDirectory
# User accounts that do not require Kerberos pre-authentication (userAccountControl 0x400000). Read-only.

$filter = '(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))'

Get-ADUser -LDAPFilter $filter -Properties DoesNotRequirePreAuth, PasswordLastSet, LastLogonDate |
    Sort-Object @{ Expression = 'Enabled'; Descending = $true }, Name |
    Select-Object Name, SamAccountName, Enabled, DoesNotRequirePreAuth, PasswordLastSet, LastLogonDate, DistinguishedName

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Where to run it

A domain-joined machine with the Active Directory module (RSAT) installed.

Reading the output

  • Finds user objects with DONT_REQ_PREAUTH (0x400000) set in userAccountControl, the flag Set-ADAccountControl -DoesNotRequirePreAuth controls.
  • Pre-authentication is on by default. Without it, anyone can ask a domain controller for authentication data for the account without proving they know its password, which can then be attacked offline. Most environments should have no accounts here; any that remain need a documented reason and a long password.
  • Disabled accounts are included and marked Enabled = False.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.

Get-ADUser (ActiveDirectory)Set-ADAccountControl (ActiveDirectory)Use the UserAccountControl flags to manipulate user account propertiesabout_ActiveDirectory_Filter (Filter and LDAPFilter, bitwise AND matching rule)Search filter syntax (LDAP_MATCHING_RULE_BIT_AND and presence filters)about_ActiveDirectory_ObjectModel (LastLogonDate, PasswordLastSet and the account flag properties)Sort-Object (Microsoft.PowerShell.Utility)Select-Object (Microsoft.PowerShell.Utility)
All scripts