{"id":5209,"date":"2026-04-13T13:34:25","date_gmt":"2026-04-13T13:34:25","guid":{"rendered":"https:\/\/geekmungus.co.uk\/?p=5209"},"modified":"2026-04-13T13:34:25","modified_gmt":"2026-04-13T13:34:25","slug":"reset-active-directory-krbtgt-password","status":"publish","type":"post","link":"https:\/\/geekmungus.co.uk\/?p=5209","title":{"rendered":"Reset Active Directory KRBTGT Password"},"content":{"rendered":"\n

The periodic reset of the KRBTGT password is now recommended by Microsoft to be carried out every 180 days. Resetting the password periodically reduces the risks of a Kerbroasting attack being successful.<\/p>\n\n\n\n

To ensure the KRBTGT password is fully reset you MUST perform this reset operation twice. And you MUST wait a bare minimum of 10 hours between password resets<\/strong>. The 10 hours are the default Maximum lifetime for user ticket and Maximum lifetime for service ticket policy settings, hence in a case where the Maximum lifetime period changes, the minimum waiting period between resets should be greater than the configured value.<\/p>\n\n\n\n

It is therefore strongly recommended to wait 24 hours between resets, rather than just the minimum recommended 10 hours.<\/p>\n\n\n\n

Resetting the KRBTGT account password twice is essential because Active Directory stores the previous two passwords for Kerberos ticket validation. The first reset creates a new password but keeps the (potentially) compromised one in history; the second reset eliminates the old password entirely, rendering active forged “golden tickets” invalid.<\/p>\n\n\n\n

It is not recommended to automate the process of resetting the KRBTGT password due to the risk of the process going wrong and resulting in service unavailability.<\/strong><\/p>\n\n\n\n

Do not attempt to reset the KRBTGT_AzureAD account password without fully understanding the process and what is required, there is a specific process that differs from the below for resetting this particular account password.<\/strong><\/p>\n\n\n\n

https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/howto-authentication-passwordless-security-key-on-premises<\/a><\/p>\n\n\n\n

How to complete the reset of this particular KRBTGT_AzureAD account is beyond the scope of this article; as is the reset of the KRBTGT_XXXXX (Number) accounts used by Read Only Domain Controllers.<\/p>\n\n\n\n

Find Last Change Date (Powershell)<\/h1>\n\n\n\n

Find when the KRBTGT password was last changed with:<\/p>\n\n\n\n

Get-ADUser \"krbtgt\" -Property Created, PasswordLastSet<\/code><\/p>\n\n\n\n

You should see an output such as the following which shows that the KRBTGT password was last reset on 13th December 2012 at 09:21:05<\/strong> in the morning.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Find Last Change Date (Script)<\/h1>\n\n\n\n

Find when the KRBTGT password was last changed with the below script, this script has the added bonus that it will seek out and find all of the KRBTGT accounts you may have in your domain and report on those.<\/p>\n\n\n\n

Be aware that you only have one KRBTGT account per Active Directory Domain, the additional accounts will only exist if you have Read Only Domain Controllers (RODC) and\/or Active Directory Directory Sync to Microsoft 365.<\/p>\n\n\n\n

krbtgt_getinfo.ps1<\/strong><\/p>\n\n\n\n

import-module activedirectory\n$ADForestRootDomain = (Get-ADForest).RootDomain\n$AllADForestDomains = (Get-ADForest).Domains\n$ForestKRBTGTInfo = @()\nForEach ($AllADForestDomainsItem in $AllADForestDomains)\n{\n[string]$DomainDC = (Get-ADDomainController -Discover -Force -Service \u201cPrimaryDC\u201d -DomainName $AllADForestDomainsItem).HostName\n[array]$ForestKRBTGTInfo += Get-ADUSer -filter {name -like \u201ckrbtgt*\u201d} -Server $DomainDC -Prop Name,Created,logonCount,Modified,PasswordLastSet,PasswordExpired,msDS-KeyVersionNumber,CanonicalName,msDS-KrbTgtLinkBl\n}\n$ForestKRBTGTInfo | Select Name,Created,logonCount,PasswordLastSet,PasswordExpired,msDS-KeyVersionNumber,CanonicalName | ft -auto<\/code><\/pre>\n\n\n\n
Gets the output of:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
As you can see we can see a number of KRBTGT accounts, the one called “KRBTGT” is domain’s Ticket Granting Ticket account, it is this which we want to reset (typically), the other two called KRBTGT_35708 and KRBTGT_4536 are used by RODC, we typically won’t need to reset these, but you may also wish to. The last one KRBTGT_AzureAD is a special use KRBTGT account for Active Directory ADSync.<\/p>\n\n\n\n
Find Maximum TGT Lifetime (in Hours)<\/h1>\n\n\n\n
Unless the lifetime has been changed by someone, this will be set to the default 10 Hours. To verify this the following PoweShell may be used. The GUID is apparently the same across any forest and domain, but add your Domain you want to inspect at the end:<\/p>\n\n\n\n
[xml]$gpo = Get-GPOReport -Guid '{31B2F340-016D-11D2-945F-00C04FB984F9}' -ReportType Xml -ErrorAction Stop -Domain internal.domain.com\n\n$MaxTgtLifetimeHours = (($gpo.gpo.Computer.ExtensionData | Where-Object { $_.name -eq 'Security' }).Extension.ChildNodes | Where-Object { $_.Name -\neq 'MaxTicketAge' }).SettingNumber\n\nWrite-Host \"$MaxTgtLifetimeHours Hours\"<\/code><\/pre>\n\n\n\n
You should now get a number the output showing the Maximum TGT Lifetime in hours.<\/p>\n\n\n\n
Up to Date Credential Encryption<\/h1>\n\n\n\n
As per this article: https:\/\/adsecurity.org\/?p=483<\/a>, the following is mentioned:<\/p>\n\n\n\n
\n
Note: Changing the KRBTGT password is only supported by Microsoft once the domain functional level is Windows Server 2008 or greater. This is likely due to the fact that the KRBTGT password changes as part of the DFL update to 2008 to support Kerberos AES encryption, so it has been tested.<\/p>\n<\/blockquote>\n\n\n\n
So because the domain and forest is now running beyond the 2008 functional level, we are at the time of writing on 2016 Functional Level (for Domain and Forest), the DFL triggered a reset of the password, therefore it has AES credentials (effectively), so although we appear to be good, we’ll reset the password anyway. We’re concerned about this because of the retirement of the RC4 Cipher in April 2026, in our case it appears the KRBTGT has the necessary AES credentials, but a reset of the KRBTGT password will just ensure doubly that this is the case.<\/p>\n\n\n\n
KRBTGT Password Reset Procedure<\/h1>\n\n\n\n
The password reset can be completed manually (its not a complicated procedure), the Microsoft article: https:\/\/learn.microsoft.com\/en-us\/windows-server\/identity\/ad-ds\/manage\/forest-recovery-guide\/ad-forest-recovery-reset-the-krbtgt-password<\/a> explains how to complete these steps. We are going to use a script that has been written for just this purpose.<\/p>\n\n\n\n
Like with many things, you just do what Ali says: https:\/\/www.alitajran.com\/krbtgt-password-reset\/<\/a><\/p>\n\n\n\n
Step 1 – Considerations for Multi-Domain and Forest Trusts<\/h2>\n\n\n\n
Because we only have a single domain within the forest we do not need to follow the process of resetting the KRBTGT in each child domain first (citation<\/a>).<\/p>\n\n\n\n
No considerations could be found that referenced a problem with resetting the KRBTGT and any effect on the Forest Trust to the hinxtonit.com<\/a> Forest (and domain).<\/p>\n\n\n\n
Step 2 – Ensure Backups of Active Directory Exist<\/h2>\n\n\n\n
Ensure you have valid Active Directory backups available and recently taken and tested so you can perform a restoration of the whole of Active Directory if it were so to be required.<\/p>\n\n\n\n
Step 3 – Check Active Directory Health and Replication Status<\/h2>\n\n\n\n
To manually check the replication status you can use the commands to look for any issues identified:<\/p>\n\n\n\n
repadmin \/showrepl\nrepadmin \/replsummary\nrepadmin \/queue<\/code><\/pre>\n\n\n\n
Other useful commands can be found in:\u00a0https:\/\/activedirectorypro.com\/repadmin-how-to-check-active-directory-replication\/<\/a><\/p>\n\n\n\n
Step 4 – Reset the KRBTGT Account Password – 1st Time Pass<\/h2>\n\n\n\n
From an Active Directory Domain Controller, using a user accont with Domain Admin privileges perform the following steps:<\/p>\n\n\n\n
1. Select Start<\/strong>, point to Control Panel<\/strong>, point to Administrative Tools<\/strong>, and then select Active Directory Users and Computers<\/strong>.
2. Select View<\/strong>, and then select Advanced Features<\/strong>.
3. In the console tree, double-click the domain container, and then select Users<\/strong>.
4. In the details pane, right-click the krbtgt <\/strong>user account, and then select Reset Password<\/strong>.
5. Clear (untick) <\/strong>the User must change password at next logon<\/strong> check box, and then click OK<\/strong>. Important!
6. In New password<\/strong>, type a new password, retype the password in Confirm password<\/strong>, and then select OK<\/strong>.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
The password that you specify isn’t significant because the system generates a strong password automatically independent of the password that you specify. But you may want to make a record of it anyway.<\/p>\n\n\n\n
The following PowerShell will generate a random secure password which you may want to use, but being that the system generates another one that it actually uses its kind of irrelevant.<\/p>\n\n\n\n
[Reflection.Assembly]::LoadWithPartialName(\u201cSystem.Web\u201d)\n$RandPassLength = [int] 128\nWrite-Output \u201cGenerating Random Password of $RandPassLength Characters\u201d\n$RandomPassword = [System.Web.Security.Membership]::GeneratePassword($RandPassLength,2)\n$RandomPassword<\/code><\/pre>\n\n\n\n
Step 5 – Verify Password Reset after 1st Time Pass<\/h2>\n\n\n\n
Verify the KRBTGT account password has been changed by running the PowerShell command:<\/p>\n\n\n\n
Get-ADUser \"krbtgt\" -Property Created, PasswordLastSet<\/code><\/pre>\n\n\n\n
And observing that the date and time of the PasswordLastSet<\/strong> attribute have changed to the date and time of the 1st password change attempt.<\/p>\n\n\n\n
Event Viewer<\/h3>\n\n\n\n
Examine the Windows Event log, specifically the Security log and look for the following event IDs, potentially in this order:<\/p>\n\n\n\n