Kerberos: password of krbgt user

Dear WilliamDaveo,

The message “EventID: 0x8000002A – The Kerberos Key Distribution Center lacks strong keys for account krbtgt” indicates that the current krbtgt account password does not meet modern cryptographic standards required for secure Kerberos authentication.

You are correct that resetting the krbtgt account password is the recommended action. This process should be performed twice, with a strong password, to fully update the Kerberos encryption keys across your domain. After each reset, the system will automatically propagate the new keys—no manual field updates are required. However, we strongly advise performing this operation during a maintenance window and ensuring all domain controllers are online and replicating properly.

While the reset is generally safe, it may temporarily affect Kerberos ticket validation if replication is delayed or if legacy systems rely on older encryption types. To minimize risk, verify that all domain controllers are healthy and that no services are hardcoded to use outdated tickets. Monitoring authentication logs post-reset can help identify any anomalies early.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

Best regards,

Harry Phan

Dear Harry Phan,

you wrote:

indicates that the current krbtgt account password does not meet modern cryptographic standards required for secure Kerberos authentication.

You are saying about latest security protocol which are not installed e.g. It's missing SHA-3 but It's installed only SHA-2 or you are saying about It's not set robust password for krbtgt user ?