Directory & authenticationTCP/UDP 88 Encrypted
Port 88: Kerberos
Kerberos
Ticket-based authentication used by Active Directory. Domain controllers run the Key Distribution Center on port 88.
How attackers abuse it
- Kerberoasting: requesting service tickets and cracking service-account passwords offline.
- AS-REP roasting accounts without pre-authentication.
- Golden and silver tickets after credential theft.
How to defend it
- Long random passwords or managed service accounts for SPN accounts.
- Prefer AES encryption and monitor for RC4 ticket requests (event 4769).
- Protect the KRBTGT account and rotate it after compromise.
Exam tip
Kerberos depends on time synchronisation - large clock skew breaks authentication, which is why NTP matters in a domain.