KRBTGT Account Password

Question

Can we change the KRBTGT account password without any issues or errors?

Is it neccesary to change it, since it has been set for years?

Can it be harmfull to not change it?

Answer 1

Hello Henny Mulder1,

Thank you for posting in Microsoft Community forum.

Can we change the KRBTGT account password without any issues or errors?

A: What are Microsoft Recommendations on KRBTGT Reset?

There is no specific recommendation regarding password reset for the KRBTGT account.

Although you can reset it periodically even without any indicators of compromise, you should plan the interval of resets for your organization taking into considerations your backup schedules, operational procedures, security requirements, etc.

However, that is a separate discussion to have, and we are more over going to discuss what exactly happens during a KRBTGT reset and few other queries which came up when discussed this with one of our Mission Critical customers.

Is it neccesary to change it, since it has been set for years?
A: I think you do not need to reset it, if everything is OK.

Can it be harmfull to not change it?
A: Is there a way to reset KRBTGT account safely without having any impact on the environment?
If you maintain a gap of 10 hours or more between KRBTGT account password resets, this may minimize the impact significantly and makes the auditors happy. However this may not add any benefit from a Security prespective.

For more information, you can read link below:
FAQs from the Field on KRBTGT Reset - Microsoft Community Hub

I hope the information above is helpful.

If you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou