Krbtgt account change password

[donherberts (dherberts)]

I have a client that has lots of these events in the system eventlog.
Why have I never heard of this needing to be done before?
I logged into a few of my clients dc’s and the krbtgt account is disabled on them?
If this is normal then I assume changing the password won’t affect anything with the dc?
Any information appreciated

[jarmbrister]

I’m sure helpful advice will be incoming shortly. However, you may want to sanitize the screenshot for your client’s privacy.

[donherberts (dherberts)]

Thanks, I thought I had a clean screenshot.

[questbahlin]

It’s pretty normal for the krbtgt account to be disabled, however the password should still be rotated (twice, separated by 24 hours) every 180 days. Here’s a great writeup on this:

KRBTGT account password reset

[phildrew]

Pretty sure that’s going to be this: KB5021131: How to manage the Kerberos protocol changes related to CVE-2022-37966 - Microsoft Support

The account is supposed to be disabled, so that’s not an issue.

If you never have, definitely rotate the krbtgt account password using the script from the link in the post above.

[PatrickFarrell]

Not to mention that if you upgrade to a current version of Windows Server for a domain controller, it will blow up authentication if you have a KRBTGT password that was created with old cryptography methods. Definitely rotate twice as suggested. Absolutely wait a minimum of 10 hours. I tell people a day just to play it safe.

[jarmbrister]

@phildrew

using the script from the link above

Are you referring to the link posted by questbahlin or your own?

[phildrew]

Link from the post above mine - fixed the wording.

Thanks!