Get-ADUser DoesNotRequirePreAuth baseline

Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true}

Lists accounts with Kerberos preauthentication disabled (DONT_REQ_PREAUTH), the exact surface for AS-REP Roasting attacks.

Run it as a hygiene check and as preparation for AS-REP Roasting detection: every account with the 'Do not require Kerberos preauthentication' option allows anyone to request its TGT without proving knowledge of the password, and the issued ticket can be cracked offline. The correct policy is that this list is empty or minimal and documented. With the baseline done, detection of 4768 with PreAuthType 0 (BLUE·002) gains context: you know which accounts are vulnerable by design and which are anomalies. It's also one of the first queries in a domain security assessment: the result usually surprises due to the number of legacy accounts with the option enabled.

Don't confuse it with attack detection: the query sees the condition, not the exploitation — AS-REP Roasting itself is detected in the 4768 events from the KDC. In environments with applications that legitimately use accounts without preauthentication (some old third-party solutions require it), the list should not be zero: document each account and its justification before disabling anything, or you'll break the application login. And watch out for performance in large domains: without a filter, the query traverses the entire directory; if you only care about active accounts, add the Enabled filter.