Follow this process for regular maintenance. Resetting the password twice clears old passwords from the history, so no other domain controller can replicate with this domain controller by using an old password. The password history value for the KRBTGT account is “2”, meaning it includes the two most recent passwords. If you alter the maximum lifetime period, the minimum waiting period between resets should be greater than the configured value. A ten-hour waiting period is required between resets because that’s the default maximum lifetime for user ticket and maximum lifetime for service ticket policy settings. Microsoft recommends resetting the Key Distribution Center Service Account password twice. Which password you specify is not significant because the system will generate a strong password automatically independent of the password that you specify. Enter the new password in “New password” and retype the password in “Confirm password” and select “OK”.In the Details pane, right-click the KRBTGT user account and then select “Reset Password”.In the console tree, double-click the domain container, and then select “Users”.Click on “View” and then click on “Advanced features”.If you prefer using Active Directory Users and Computers (ADUC): There are several ways to reset the password. Resetting the Kerberos password with ADUC The KRBTGT account is used in AD in the following sequence: KRBTGT authentication sequence in Active Directory You’ll also want to implement an auditing tool that can detect golden ticket attacks in your environment. Performing this action on a regular basis will stop golden ticket attacks. Plan on changing it at least twice a year. If you have had or suspect an intrusion, change that password immediately after the network has been stabilized. If the KRBTGT account password hash is stolen or broken with an attack, the attackers can then grant themselves full access to your network with the necessary authentication.Ĭhanging the Kerberos password is a must-do task if you monitor and maintain an AD infrastructure. Active Directory (AD) uses the KRBTGT in the AD domain for Kerberos tickets. When an attacker wiggles into a network, they can use the golden ticket attack sequence. Small- to medium-sized businesses, however, might not have changed them since implementing their domain infrastructure. Most large enterprises regularly change their Kerberos passwords.

Active directory kerberos