How to Configure Kerberos Armoring (FAST) in Windows 11 Using Group Policy and PowerShell

Kerberos pre-authentication is a foundational security mechanism in Active Directory environments, but standard pre-authentication exchanges are vulnerable to offline brute-force and dictionary attacks if an attacker intercepts Authentication Service Request (AS-REQ) packets. Kerberos Flexible Authentication Secure Tunneling (FAST)—commonly referred to as Kerberos Armoring—protects these exchanges by wrapping the Kerberos pre-authentication dialogue inside a secure TLS-like encrypted tunnel established using the workstation’s computer account credential.

How Kerberos Armoring Protects Enterprise Credentials

Without Kerberos Armoring, an attacker who eavesdrops on network traffic can capture encrypted user pre-authentication timestamps (encrypted using the user’s NTLM/Kerberos password hash) and perform offline cracking attacks using tools like Hashcat or John the Ripper. With Kerberos Armoring enabled, the Key Distribution Center (KDC) and client workstation encrypt the AS-REQ and AS-REP packets using the workstation’s own computer account key, preventing unauthorized decryption of the encapsulated user ticket requests.

Prerequisites for Enabling Kerberos Armoring

To deploy Kerberos Armoring successfully across Windows 11 workstations:

• Domain controllers must run Windows Server 2012 or newer with KDC support for claims, compound authentication, and Kerberos armoring enabled.
• Client machines must run Windows 8, Windows 10, or Windows 11 Enterprise/Pro.
• Both computer account and user account authentication must function reliably without replication errors.

Configuring Kerberos Armoring via Local Group Policy

To configure Kerberos Armoring on an individual Windows 11 workstation or through domain-wide Group Policy (GPO):

1. Press Win + R, type gpedit.msc, and press Enter to open the Local Group Policy Editor.
2. Navigate to: Computer Configuration > Administrative Templates > System > Kerberos.
3. Locate the policy setting named Kerberos client support for claims, compound authentication and Kerberos armoring.
4. Double-click the policy, select Enabled, and ensure the configuration dropdown is set to Supported (or Always provide claims if domain-wide enforcement is already active).
5. Click Apply and OK.
6. Open a command prompt and refresh policies immediately:

   gpupdate /force

Verifying Kerberos Armoring Status with PowerShell

Administrators can inspect the active Kerberos client configuration using PowerShell:

# Query the Kerberos registry policy settings:
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters" -ErrorAction SilentlyContinue

To verify that issued Kerberos tickets utilize armoring:

1. In PowerShell, execute klist to inspect active Ticket Granting Tickets (TGT):

   klist tgt

2. Check the Ticket Flags output. When Kerberos Armoring is active, look for the flag 0x40000000 or descriptive flags indicating armored or pre-authenticated.

Auditing and Enforcement Considerations

Before moving from Supported to strict domain-wide enforcement (rejecting unarmored authentication requests at the KDC):

• Monitor Security Event Log for Event ID 4771 (Kerberos pre-authentication failed) on Domain Controllers.
• Verify that non-Windows legacy appliances (such as Linux file servers or older network scanners) support RFC 6113 FAST before enforcing strict requirements across the domain.

Deploying Kerberos Armoring on Windows 11 neutralises offline credential harvesting attacks, establishing robust baseline identity security across Active Directory infrastructures.