A Kerberoasting attack turns a single low-privilege domain account into cracked service credentials, and often into Domain Admin. Here is the full chain and the fixes that actually work.