# KRBTGT password age should not exceed the configured maximum

Security Risks: - Golden Ticket Attacks: Compromised KRBTGT password allows attackers to forge TGTs for any user - Persistent Access: Attackers can…

Source: https://maester.dev/docs/tests/AD-KRBTGT-01

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Account security · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-KRBTGT-01
```

## Overview

- The KRBTGT account is the most critical service account in Active Directory. It is used by the Key Distribution Center (KDC) service to encrypt and sign all Kerberos tickets within the domain. If this account is compromised, an attacker can forge Kerberos tickets (Golden Tickets) that grant unlimited access to any resource in the domain.

**Security Risks:**
- **Golden Ticket Attacks**: Compromised KRBTGT password allows attackers to forge TGTs for any user
- **Persistent Access**: Attackers can maintain access even after password changes if they create forged tickets with long lifetimes
- **Domain-Wide Impact**: A single compromised KRBTGT affects the entire domain

#### Control Type

**Preventive**

#### Security Recommendation

1. **Rotate KRBTGT password regularly**:
   - At least every `MaximumPasswordAgeDays` days (default 180, about twice per year)
   - Immediately if compromise is suspected

2. **If compromise is suspected**:
   - Rotate the password **twice** with at least 10 hours between rotations
   - First rotation invalidates existing forged tickets
   - Second rotation ensures any tickets created between rotations are also invalidated

3. **Monitor for anomalies**:
   - Unexpected password changes
   - Unusual authentication patterns
   - KRBTGT account being enabled (it should always be disabled)

#### How the Test Works

This test retrieves the KRBTGT account from Active Directory and checks:
- Password last set date
- Days since last password change
- Whether password age exceeds `MaximumPasswordAgeDays` (default 180)
- Account status (should be disabled)

#### Related Tests

- `Test-MtAdKrbtgtLastLogon` - Verifies KRBTGT has no interactive logons
- `Test-MtAdKrbtgtNonStandardUacCount` - Validates KRBTGT has standard UAC settings

#### Related links

- [Microsoft Defender for Identity: Change password for krbtgt account](https://learn.microsoft.com/defender-for-identity/security-posture-assessments/accounts#change-password-for-krbtgt-account)
- [ANSSI Active Directory checkpoints: Krbtgt account password unchanged for more than a year](https://www.cert.ssi.gouv.fr/uploads/ad_checklist.html#vuln_krbtgt)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-KRBTGT-01 |
| Severity | Medium |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Account security |
| Area | Authentication |
| Resource type | User |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1558.001 Golden Ticket |
| Supports controls | nist-800-53-r5:IA-5 |
| PowerShell test | [Test-MtAdKrbtgtPasswordLastSet](https://github.com/maester365/maester/blob/main/tests/ad/security/Test.AD-KRBTGT-01.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:user:ReadProperty |

</details>

## Source

- Test: [`tests/ad/security/Test.AD-KRBTGT-01.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/security/Test.AD-KRBTGT-01.ps1)
- Documentation: [`tests/ad/security/Test.AD-KRBTGT-01.md`](https://github.com/maester365/maester/blob/main/tests/ad/security/Test.AD-KRBTGT-01.md)