How to Enable and Configure Kerberos Armoring (FAST) in Windows 11 for Active Directory Authentication Security

In enterprise Active Directory environments, standard Kerberos pre-authentication exchanges transmit user authentication metadata across the local network. Although hashed, offline attackers capturing these network packets can mount brute-force dictionary attacks against user Kerberos AS-REQ pre-authentication data. Kerberos Armoring, formally designated as Flexible Authentication Secure Tunneling (FAST), shields initial authentication exchanges by encapsulating them inside an encrypted tunnel established using the computer’s own machine credentials.

What Is Kerberos Armoring (FAST) and How Does It Protect Windows 11?

Introduced in RFC 6113 and implemented natively across modern Windows operating systems, Kerberos Armoring enhances domain security in multiple ways:

• Encrypted AS Exchanges: Encrypts the initial authentication service (AS) request and reply between the Windows 11 client and the Active Directory Domain Controller (DC) using a key derived from the computer account.
• Mitigates Offline Brute-Forcing: Attackers sniffing network traffic cannot extract user pre-authentication hashes to crack domain passwords offline.
• Enforces Compound Authentication: Allows Domain Controllers to evaluate both the identity of the user and the identity of the computer when granting access to sensitive file shares.
• Downgrade Resistance: Prevents malicious intermediary proxies from forcing downgrade attacks to vulnerable legacy NTLM protocols.

Prerequisites for Enabling Kerberos Armoring

Before enforcing Kerberos Armoring on Windows 11 client workstations, verify your environment readiness:

1. Domain Controller Support: All Domain Controllers must run Windows Server 2012 or newer.
2. Domain Functional Level: Windows Server 2012 or higher.
3. DC Policy Activated: The Domain Controller Group Policy must have KDC support for claims, compound authentication and Kerberos armoring enabled.

Enabling Kerberos Client Armoring via Local Group Policy

You can configure Kerberos Armoring directly on individual Windows 11 Pro and Enterprise systems:

1. Press Win + R, type gpedit.msc, and press Enter to launch the Local Group Policy Editor.
2. Navigate to the following policy path:
   Computer Configuration > Administrative Templates > System > Kerberos
3. In the right-hand pane, double-click the policy named Kerberos client support for claims, compound authentication and Kerberos armoring.
4. Set the policy to Enabled.
5. Click Apply and then OK.
6. Open an elevated PowerShell window and execute:

   gpupdate /force

Verifying Kerberos Armoring via Klist

To confirm that your active Kerberos Ticket Granting Ticket (TGT) is armoured with FAST:

1. Open a standard command prompt or terminal window.
2. Execute the klist command with the tgt flag:

   klist tgt

3. Inspect the output flags. If Kerberos Armoring is active, the ticket attributes will include Tkt-Flags: ... armored, confirming that authentication packets are securely tunnelled inside machine-level encryption.