During a county AD review, several users are found with Kerberos pre-authentication disabled. What does that configuration class represent?
Select an answer to reveal the explanation.
Short Explanation
Pre-auth is like showing ID before you get the ticket. Turn it off and the ticket process gets a lot friendlier for the wrong people. Flag users missing pre-auth as a real exposure class.
Full Explanation
During a county AD review, users with Kerberos pre-authentication disabled represent a recognized exposure class associated with AS-REP-style themes and weaker authentication guarantees—not a performance optimization that removes credential risk. The setting is not proof that smart-card login is enforced domain-wide, nor evidence that NTLM has been fully disabled across the forest. Exam caveat: name the exposure class and remediation direction without delivering an attack tutorial in the main finding body. Operational check: list affected accounts from authorized enumeration, confirm whether any business exception is documented, recommend re-enabling pre-authentication, and monitor for abnormal authentication patterns while exceptions are removed. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services. Re-validate the same judgment after the next change window so the control still holds under the city’s current tooling, identity posture, and RoE amendments. Keep secret material and session artifacts in the approved vaulted workflow rather than chat paste or unprotected tickets used by mixed municipal teams.