KRBTGT Account Management
The KRBTGT account is the master key to your entire Kerberos infrastructure — its password hash encrypts every TGT, and rotating it is the only way to invalidate Golden Tickets.
Every time you log into a Windows domain, the Kerberos system gives you a Ticket-Granting Ticket (TGT) that proves your identity. These TGTs are encrypted using the KRBTGT account's password hash — a special built-in account that exists solely for this purpose. If an attacker gets the KRBTGT hash (via DCSync or NTDS.dit extraction), they can forge their own TGTs (Golden Tickets) for any user, including Domain Admin, with any expiration date they choose. The only way to stop Golden Tickets is to change the KRBTGT password — and you must change it TWICE because AD keeps the current and previous password, accepting both.
In a kingdom, the Royal Mint has a master stamp used to authenticate every gold coin. If a counterfeiter steals an impression of this stamp, they can produce unlimited fake coins that pass inspection. The only fix is to destroy the old stamp and create a new one — then re-stamp all legitimate coins. The KRBTGT account is the master stamp: it signs every Kerberos TGT. If an attacker gets the KRBTGT hash, they forge unlimited Golden Tickets. Rotating the password is like replacing the stamp — but you must do it twice because the mint keeps one backup stamp.
Try It Yourself
Key Takeaways
- The KRBTGT hash encrypts every TGT in the domain — compromise it and you can forge Golden Tickets.
- KRBTGT password must be reset TWICE to fully invalidate all Golden Tickets.
- Wait for full replication + max ticket lifetime between the two resets.
- Many organizations have never rotated KRBTGT since domain creation — fix this immediately.
- KRBTGT rotation alone is insufficient if attackers have AD CS certificates or other persistence.
The KRBTGT account is the single most important secret in Active Directory. Regular rotation limits Golden Ticket lifetime, and knowing how to perform an emergency double-rotation is essential for incident response.