How many KRBTGT account we should have in active directory domain and forest

Question

Hello Expert community,

How many krbtgt account we should have on each domain and forest ?

There is any impact on Entra ID if we delete it ?

Answer 1

Hi @LULU •

How many krbtgt account we should have on each domain and forest ?

You should have one krbtgt account for all Read and write domain controller on each domain.

You can also have many krbtgt accounts if you have a RODC promoted in your domain. Because a RODC create its own krbtgt account and not use the existing one alreday used by R/W domain controlers.

There is any impact on Entra ID if we delete it ?

It's not recommended to remove krbtgt account because you will impact kerberos authentication on all your domain not only Entra ID.

This is a critical account and you should reset its password at lease ywo time per year for security reason.

---

Please don't forget to accept helpful answer