Re: Reset password on 'krbtgt' account?

From: Mark Gamache (mark.gamache_at_css-security.com)
Date: 02/03/05 

Date: Wed, 2 Feb 2005 17:33:39 -0800

I'm actually dying to hear the official MS answer.

Here's mine. Don't touch it. It is the service account for you Kerberos
KDC. It is managed by AD. It is already a strong random password by
default.

Cheers, 

-- 
Mark Gamache
Certified Security Solutions
http://www.css-security.com
"Research Services" <key@lamar.n0-sp@m.colostate.edu.NO> wrote in message 
news:%23V7PsCVCFHA.2572@tk2msftngp13.phx.gbl...
> We noticed that in our Child Domain (part of an Active Directory Forest), 
> that the 'krbtgt' account is Disabled.  Can we safely Reset the Password 
> on this account to something long and complex?
>
>
>
>

Relevant Pages

  • Re: impersonation using kerberos
    ... and then finding out you can enable kerberos event logging.... ... and for the computer account contains ... This error appears on my SQL box ... KDC cannot accommodate requested option. ...
    (microsoft.public.win2000.active_directory)
  • RE: [Full-disclosure] Support_388945a0 account in Win XP/2003
    ... >> Also set very long random password and forget it. ... > But I heard a rumours that this account can be activated remotely ... Deleting it might cause problems "help and support" ... just deny the account all kinds of privs and it would no longer matter. ...
    (Full-Disclosure)
  • Re: [Full-disclosure] Support_388945a0 account in Win XP/2003
    ... Also set very long random password and forget it. ... But I heard a rumours that this account can be activated remotely without user's aware decision and used for Remote Assistance. ... Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ...
    (Full-Disclosure)
  • Re: SSH ignores locked accounts
    ... >> locking the account. ... or can't for some reason, you could set a random password, not tell ... Good judgement comes with experience. ...
    (comp.security.ssh)
  • Renaming the local Administrator account on Windows XP Pro
    ... the local Administrator account with a randomly generated name. ... create a random password with the following command: ... net user Administrator /random ... This will generate a random strong password for the local Administrator ...
    (microsoft.public.windowsxp.security_admin)