KRBTGT account

KRBTGT is the built-in, disabled account every Active Directory domain creates to hold the Key Distribution Center’s long-term key. Its password hash is what encrypts and signs every Ticket Granting Ticket issued in the domain. No one logs in as KRBTGT; the account exists purely as key material, which is why its password normally never changes.

That permanence is the problem. An attacker who extracts the KRBTGT hash, typically via a DCSync attack against a domain controller, can mint valid TGTs indefinitely: the golden ticket attack. Recovery requires resetting the KRBTGT password twice, because the KDC honours both the current and previous key. One reset leaves forged tickets under the old key still valid; the second reset, after replication completes, finally invalidates them.

Exam relevance: two facts get tested. First, the KRBTGT hash is the single secret behind every TGT, so its compromise means domain-wide, persistent compromise. Second, the double reset with a replication pause between resets is the remediation; resetting once, or twice in quick succession, are the distractors.