While helping Andrew Schwartz with his Kerberos FAST post (which has more information about what FAST is and how it works, so have a read), I noticed something interesting. AS-REQs for machine accounts are unarmored. This is described by Microsoft here: Kerberos armoring uses a ticket-granting ticket (TGT) for the device to protect authentication service …