Resetting AD KRBTGT Password

Luke Hebert

- 2 minutes read - 265 words

Resetting the krbtgt account password is a critical step in Active Directory recovery, especially after a suspected compromise. Done correctly, it invalidates all existing Kerberos ticket-granting tickets (TGTs) without disrupting keytabs or other credentials your services rely on.

Considerations

Warning

Resetting the krbtgt password is a disruptive operation. Keep the following in mind before you proceed:

  • It may impact external trusts that are not managed directly by Active Directory (for example, MIT Kerberos or FreeIPA).
  • It invalidates all active TGTs, so users and services will need to re-authenticate.
  • It does not invalidate existing keytabs or other credentials.

The Reset Script

Microsoft provides the Reset-KrbtgtKeyInteractive-v1.4 script, which lets you:

  1. Perform a single reset of the krbtgt account password (run it multiple times for subsequent resets).
  2. Validate that all writable domain controllers in the domain have replicated the keys derived from the new password, so they can begin using the new keys.

The script operates in three modes:

  • Informational - displays current krbtgt key status without making changes.
  • Estimation Mode - estimates the impact of a reset before you commit.
  • Reset - performs the actual password reset and replication validation.

When to Use a Double Reset

The krbtgt account password reset script guide includes a step-by-step task list for performing the reset. It also covers the scenario where you want to invalidate all existing TGTs by performing a double reset of the krbtgt account secret. This is recommended during a comprehensive Active Directory recovery to ensure no stale tickets remain valid.

References