Skip to content

userAccountControl 4194816: User, no Kerberos preauthentication

userAccountControl Decoder: Decode Active Directory userAccountControl values (512, 514, 66048, 532480) into flags, see what each means and how to set it, or build one.

Active Directory keeps an account's switches (disabled, password never expires, trusted for delegation…) as bits added up in its userAccountControl attribute: 66048 is 65536 + 512. Type a value from ADSI Edit, Get-ADUser -Properties userAccountControl or a security report to see which flags it holds, what each means and how to change it, or tick flags below to build one. Flag names and values are from Microsoft's UserAccountControl property flags.

Try: 512, 514, 66048, 532480, 4096, 590336

User, no Kerberos preauthentication

4194816 = 0x400200 = 512 + 4194304

ValueFlagMeaning
512
0x200		 NORMAL_ACCOUNT An ordinary user account.
Every user has it; 512 alone is a plain, enabled user.
4194304
0x400000		 DONT_REQ_PREAUTH
review
 Kerberos pre-authentication isn't required.
Anyone can request data for this account and try to crack its password offline (AS-REP roasting). Clear it unless something old needs it.
Active Directory Users and Computers: "Do not require Kerberos preauthentication"
PowerShell: Set-ADAccountControl -DoesNotRequirePreAuth $true

Find accounts like this

Exactly this valueGet-ADObject -LDAPFilter "(userAccountControl=4194816)" -Properties userAccountControl
Users with these flagsGet-ADUser -LDAPFilter "(userAccountControl:1.2.840.113556.1.4.803:=4194304)"
LDAP filter(userAccountControl:1.2.840.113556.1.4.803:=4194304)
1.2.840.113556.1.4.803 is LDAP's bitwise AND rule: it matches accounts that have at least these bits, whatever else is set.

Change it: tick flags to build a new value

IncludeValueFlagMeaning
1 Run the logon script. Kept for old clients; the scriptPath attribute is what matters today.
2 The account is disabled and can't sign in.
8 A home folder is required.
16 The account is locked out.
32 The account may have an empty password, whatever the password policy says.
64 The user can't change their own password.
128 The password is stored with reversible encryption, close to plain text.
256 A local account for a user whose main account is in another domain (pre-Windows 2000 domains).
512 An ordinary user account.
2048 The account a domain uses for a trust with another domain.
4096 A computer account: a workstation or a member server.
8192 A domain controller's computer account.
65536 The password never expires.
131072 A Majority Node Set (cluster) logon account.
262144 Interactive sign-in needs a smart card.
524288 Unconstrained delegation: services on this account can act as any user who signs in to them, anywhere.
1048576 The account can't be delegated by any service, even one trusted for delegation.
2097152 Kerberos may use only DES keys for this account.
4194304 Kerberos pre-authentication isn't required.
8388608 The password has expired.
16777216 Constrained delegation with protocol transition: the account can get tickets as a user to the services it's allowed to, without that user's password.
67108864 A read-only domain controller (RODC) computer account.