Skip to content
  • There are no suggestions because the search field is empty.

How do I scan using Kerberos authentication?

With Kerberos authentication, the scanner logs in to Windows hosts in your Active Directory domain using Kerberos instead of NTLM. You can use Kerberos authentication with our cloud scanners and with your own Scanner Appliance. This article describes the requirements and how to add Kerberos authentication to a network scan profile.

What do I need before I start?

  • A domain account that is a member of the local Administrators group on the target hosts.
  • Network access from the scanner to a domain controller on port 88 (TCP and UDP). 
  • DNS resolution of the target hostnames and the domain controller from the scanner.
  • Time on the scanner and the domain controller that differs by no more than five minutes.
  • Kerberos authentication for authenticated scans is only supported on Generation 4 Scanner Appliances. Generation 3 Scanner Appliances (version 3.21.0 or older) are not supported. 

The general Windows requirements for authenticated scans also apply. Read more in What are the supported systems & requirements?

Scanner Appliance version
Existing Scanner Appliances cannot be upgraded, so you will need to install a new one.
How do I install a Scanner Appliance?

How do I add Kerberos authentication to a scan profile?

  1. Log in to Security Center.
  2. Click Assessments > Profiles.
  3. Open the network scan profile you want to use, or create a new one.
  4. Click Authentication and select Kerberos.
  5. Click Add credentials.
  6. Enter the following:
    • Record name: The Security center label for the credentials.
    • Username: the domain account, e.g., "svc-scan". [CONFIRM: format]
    • Password: the password for the domain account.
    • Realm: the fully qualified domain name, e.g., "YOURORGANIZATION.COM".
    • KDC: the hostname or IP address of the domain controller.
  7. Click OK.
  8. Done!

Use hostnames as scan targets
Kerberos uses hostnames, not IP addresses, to identify hosts. If you scan by IP address, authentication may fail.

How do I check that the authentication worked?

After the scan, check the authentication status for each host. Read more in How do I see if an authenticated network scan was successful or not?


Why does Kerberos authentication fail?
The most common causes are:

  • The time difference between the scanner and the domain controller is more than five minutes.

  • The scanner cannot resolve the target hostname or the domain controller in DNS.
  • Port 88 is blocked between the scanner and the domain controller.
  • The target was added as an IP address instead of a hostname.
  • The domain account is not a member of the local Administrators group on the target host.