Golden Ticket attacks target the ticket authority
If an attacker obtains the key that signs authentication tickets, they can mint valid tickets for anybody, including accounts that do not exist.
At that point they are not bypassing authentication, they are issuing it. Recovery requires rotating that key twice and is one of the reasons a directory compromise is so much more serious than an ordinary one.
More on Windows and Active Directory
- Domain Admin is a forest-scale keyOne root under the whole forest
- Kerberos tickets are credentialsWhoever holds it, gets in
- Group Policy is a fleet control planeOne dial, every desk
- LAPS reduces shared local-admin secretsOne secret, or one each
- NTLM fallback preserves older trust assumptionsThe hatch nobody bricked up
- Service accounts can become invisible administratorsThe pass with no face