Reset krbtgt password in AADDS managed domain

SEM 101 Reputation points
2021-09-08T13:18:21.43+00:00

As the title says: is it possible to reset krbtgt password in an Azure AD DS managed domain?
Bonus question: is the krbtgt automatically rotated in an Azure AD DS managed domain?

Backstory:
Having noticed that krbtgt's password last set date changed without our intervention we decided to preventively reset it.
Running the New-KrbtgtKeys.ps1 script returns an error, indicating that the administrator user has insufficient permissions, which is also described in Microsoft documentation.

Microsoft Entra
0 comments No comments
{count} votes

Accepted answer
  1. SEM 101 Reputation points
    2021-09-20T09:11:16.33+00:00

    We opened a support ticket with Microsoft regarding krbtgt password rotation and got the following answer:

    Our backend team has informed me that the krbtgt account password is rotated every 7 days.

    This confirms that the krbtgt password is automatically rotated by Microsoft in Azure AD DS.

    It would be nice if this information could be found in AADDS online documentation, but it's currently not the case.

    1 person found this answer helpful.
    0 comments No comments

1 additional answer

Sort by: Most helpful
  1. Marilee Turscak-MSFT 35,806 Reputation points Microsoft Employee
    2021-09-09T19:24:31.917+00:00

    Yes, this appears to be possible. There are scripts for this here:

    https://github.com/zjorz/Public-AD-Scripts
    https://github.com/zjorz/Public-AD-Scripts/blob/master/Reset-KrbTgt-Password-For-RWDCs-And-RODCs.ps1

    There is another thread related to this topic here.

    The keys are not automatically rotated, but you can do so via Powershell:

    Set-AzureADKerberosServer -Domain $domain -CloudCredential $cloudCred -DomainCredential $domainCred -RotateServerKey  
    

    https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises

    Let me know if this answers your question!

    1 person found this answer helpful.