Kerberos is the authentication protocol that Active Directory uses. Understanding it is essential for understanding both the Golden Ticket attack and the detection indicators that reveal it.

Kerberos in Plain Language — The Fair Analogy

Think of authenticating to a Windows domain like going to a fair with rides. When you arrive, you show your ID and get a wristband. That wristband gets you through the front gate without showing your ID again. When you want a specific ride, you show your wristband and get a ride ticket — valid for that one ride only.

In Active Directory: The fair entrance = the Domain Controller (KDC). Your wristband = the TGT (Ticket Granting Ticket). The ride ticket = the TGS (Ticket Granting Service ticket). The master signing pen that makes all wristbands valid = the krbtgt account.

Every TGT is signed with the krbtgt account’s secret key. If an attacker steals that key, they can forge a wristband for anyone — including people who do not exist — and set it to never expire. The fair has no way to tell the difference. That forged wristband is the Golden Ticket.

Why It Is Hard to Detect

The ticket is cryptographically valid — Active Directory accepts it without question. The forgery happens entirely offline; the Domain Controller is never involved in creating it. There are no disk artifacts — the ticket is injected directly into memory. A skilled attacker can operate with a Golden Ticket for months before detection.

Detection Indicators

• 4769 with no preceding 4768 — Service ticket requested but no TGT request. The TGT was forged, not issued by the DC.
• TGT lifetime exceeding 10 hours — Domain default is 10 hours. Golden Tickets are often set to 10 years.
• 4624 for unknown SIDs — Golden Tickets can impersonate accounts that do not exist in AD.
• 4662 + Replication-Get-Changes-All — DCSync: how the attacker stole the krbtgt hash in the first place.

Response: The Double Reset

If a Golden Ticket is confirmed, reset the krbtgt account password twice. Not once — twice. The first reset invalidates current tickets but attackers may have a backup. The second reset covers it. There is no patch-one-system response to a Golden Ticket — the entire domain is assumed compromised until proven otherwise.

Learning Objective

After this lesson, you can explain how Kerberos works using an analogy, describe what a Golden Ticket is and why it is dangerous, identify the detection indicators, and explain the double-reset response requirement.

Part of the free Intro to Cyber course by Cover6 Solutions.