[p_ing]

Active Directory got some major major major updates in Server 2025.

https://learn.microsoft.com/en-us/windows-server/get-started...

Including the relevant:

> Kerberos changes for Algorithms used for Ticket Granting Tickets: The Kerberos Distribution Center will no longer issue Ticket Granting Tickets using RC4 encryption, such as RC4-HMAC(NT).

[mr_mitm]

Kerberoasting specifically targets service tickets, not TGTs. I wonder if the change really only applies to TGTs or if they simply neglected to mention service tickets.