KRBTGT last logon should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Account security · All checks

Run this check

Invoke-Maester -TestId AD-KRBTGT-02

Overview

The KRBTGT account is a service account that should never have interactive logons. It exists solely for the KDC service to use internally for Kerberos ticket operations. Any logon activity for this account may indicate:

Security Concerns:

• Suspicious Activity: Interactive logons suggest potential compromise or misuse
• Account Misuse: Administrators incorrectly attempting to use the account
• Attack Indicators: Attackers may attempt to activate or use the account

The KRBTGT account should:

• Always remain disabled (UAC = 514)
• Never have interactive logons
• Only be used internally by the KDC service

Control Type

Operational

Security Recommendation

1. Never enable the KRBTGT account:

   • Standard UAC should be 514 (disabled, normal account)
   • Enabling this account creates a significant security risk

2. Monitor for logon attempts:

   • Any logon activity should be investigated immediately
   • Check security logs for attempted logons to this account

3. Audit account changes:

   • Monitor for UAC changes
   • Alert on any modifications to the KRBTGT account

How the Test Works

This test retrieves the KRBTGT account and checks:

• Last logon timestamp (should be null/never)
• Account enabled status (should be disabled)
• Password last set date

Related Tests

• Test-MtAdKrbtgtPasswordLastSet - Checks KRBTGT password age
• Test-MtAdKrbtgtNonStandardUacCount - Validates KRBTGT UAC settings

Details

Every attribute of this check

Field	Value
Test ID	AD-KRBTGT-02
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Account security
Area	Authentication
Resource type	User
MITRE ATT&CK	T1078.001 Default Accounts
PowerShell test	Test-MtAdKrbtgtLastLogon
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:user:ReadProperty

Source

• Test: tests/ad/security/Test.AD-KRBTGT-02.ps1
• Documentation: tests/ad/security/Test.AD-KRBTGT-02.md