Kerbrute User Enumeration and Password Spraying

Kerbrute can identify existing Active Directory accounts by sending unauthenticated Kerberos AS-REQs: KDC_ERR_PREAUTH_REQUIRED indicates an account requiring pre-authentication, while KDC_ERR_C_PRINCIPAL_UNKNOWN indicates an unknown principal. A separate authorized assessment may test one candidate password against a validated account list; failed pre-authentication attempts can increment lockout counters and lock accounts.