Whats the KRBTGT password?
What is this?
The krbtgt password is the password of a special built-in Active Directory account called KRBTGT (Kerberos Ticket Granting Ticket account).
The krbtgt password is the secret key that protects all Kerberos authentication in your Active Directory domain.
What does the password actually do?
When a user logs into the domain:
- The Domain Controller authenticates the user.
- The DC issues a Ticket Granting Ticket (TGT).
- That TGT is signed and encrypted using the krbtgt account password.
Every Kerberos ticket in your domain ultimately depends on that secret.
Why is it important in cybersecurity?
Because if an attacker:
- Gets Domain Admin
- Extracts the
krbtgtpassword hash
They can create Golden Tickets.
Golden Tickets allow:
- Creating fake Kerberos tickets
- Logging in as any user (including Enterprise Admin)
- Persistence even after you change admin passwords
This is why krbtgt password rotation is a critical incident response step.
Why reset it twice?
Active Directory stores:
- Current password
- Previous password
Resetting twice ensures:
- Old forged tickets become invalid
- Attackers lose persistence