Kerbrute: Active Directory User Enumeration Explained

Kerbrute is a tool for quietly attacking Active Directory through Kerberos, the protocol Windows uses to authenticate. It does two things exceptionally well: it works out which usernames are valid without triggering account lockouts, and it tests passwords against those users in a way that is quieter than any normal login attempt. Both exploit a design property of Kerberos itself, which is why it is a fixture of internal testing.

Here is what it does and, if it appears in a report against your domain, what the finding actually means.

The Kerberos quirk it abuses

When a client begins Kerberos authentication, it sends an initial request (an AS-REQ). The domain controller’s response reveals something before any password is checked: if the username does not exist, the error differs from the error when the username exists but the pre-authentication is wrong.

That difference is the whole trick. It means an attacker can distinguish valid usernames from invalid ones without ever submitting a password , and therefore without incrementing the failed-login counter that drives account lockout. Kerbrute automates this at speed.

The two things it does

Username enumeration. Given a wordlist of likely usernames , derived from the company’s email format (jsmith, john.smith), employee names from LinkedIn, or common patterns , Kerbrute confirms which correspond to real accounts. The output is a validated list of real domain users. This is reconnaissance, and because no password is ever sent, it is close to invisible to defenders watching for failed logins.

Password spraying. The counterpart to enumeration. Instead of trying many passwords against one account (which locks it), spraying tries one common password (Winter2026!, Companyname1) against many accounts. In a domain of any size, someone is using the season-and-year password. Because each account sees only a single attempt, lockout thresholds are never reached. Kerbrute performs this over Kerberos, which is quieter than authenticating against SMB or a web portal.

What its findings mean

If Kerbrute appears in a report, the findings tend to be:

• Usernames were enumerable , the domain leaks valid accounts through the Kerberos pre-authentication behaviour. This is hard to eliminate entirely but can be monitored.
• A password spray succeeded , one or more accounts used a weak, guessable password. This is the serious one: it is a valid credential, and it usually leads directly to the next stage, where a tool like NetExec maps everywhere that credential reaches.
• AS-REP roastable accounts were found , accounts with Kerberos pre-authentication disabled, whose password hashes can be requested and cracked offline. That is a specific misconfiguration with a specific fix.

The through-line is that Active Directory’s own authentication design gives an attacker a quiet way to find users and test passwords, and weak passwords remain the most reliable way into a Windows network.

How defenders detect and stop it

Kerbrute is quiet, but not silent , its activity has a signature if you are watching the right events:

• Kerberos pre-authentication failures (Event ID 4771) across many accounts from one source , the clearest indicator of a spray. Standard failed-logon monitoring (4625) may miss it, which is exactly why Kerbrute uses this path.
• A burst of authentication requests for many distinct users in a short window.

Detection matters, but prevention matters more, and it is straightforward:

1. Enforce strong password policy , length over complexity, and screen against breached-password and seasonal-pattern lists. This defeats spraying directly.
2. Multi-factor authentication , even a valid sprayed password fails at the second factor.
3. Alert on 4771 patterns, not only on lockouts , spraying is specifically designed to stay under the lockout threshold.
4. Fix AS-REP roastable accounts , enable pre-authentication everywhere it is not deliberately disabled.
5. Smart lockout / risk-based policies that recognise distributed spraying rather than counting per-account failures.

Where it fits in an engagement

Kerbrute operates at the transition from reconnaissance to initial access in internal network penetration testing and red team assessments. It turns a list of likely names into validated accounts and then into working credentials , the foothold from which lateral movement begins. A successful spray is frequently the moment an external or assumed-breach test becomes an internal compromise.

The short version

Kerbrute exploits a property of Kerberos to enumerate valid Active Directory usernames without sending passwords, then sprays common passwords across those accounts while staying under the lockout threshold. Its findings are almost always weak passwords and enumerable users , and a successful spray typically becomes the foothold for everything that follows. The defences are unglamorous and effective: strong screened passwords, MFA, and alerting on Kerberos pre-auth failures rather than only on lockouts.

Would a common password get an attacker into your domain? A spray against your own users, done safely, is a standard part of every internal penetration test we run. Scope one here.