Is Kerberoasting Still a Risk When AES-256 Kerberos Encryption Is Enabled?

This post explains that Kerberoasting remains a viable attack against AD service accounts with SPNs even in AES‑256-only environments, because attackers can perform offline dictionary/rules-based cracking against ticket material derived from weak passwords. With RC4 deprecated and AES slowing but not stopping cracking, the author emphasizes enforcing strong, random service account passwords (or managed accounts) as the primary defense rather than relying on encryption type.