Kerberoasting is an attack on service accounts, and it works because Kerberos is doing exactly what it was designed to do. Any signed-in domain user can ask a domain controller for a service ticket to any account that has a service principal name (SPN). Part of that ticket is encrypted with a key made from the service account's password, so the attacker takes the ticket away and guesses the password offline. There are no failed logons and no lockouts to notice.

So the weak point is not Kerberos. It is a human-chosen password on an account with an SPN, made worse when the ticket uses RC4 instead of AES.…