krbtgt user

[mrstrong]

Whilst "tidying" up some users with powershell I think I may have messed up big time.

 

It looks like I've disabled the krbtgt user account and moved it into a "Disabled" OU.

Apparently this account is crucial for kerberos 🤯

 

Nothing seems to have broke yet but can anyone advise ? E.g. should I just re-enable it

and move it? Which OU should it be in ?

[Koldov]

Isn't it supposed to be disabled...? Mine is!

 

BTW it's in Domain > Users

Edited June 26, 2025 by Koldov

[SteveM555]

I'm pretty sure it should already be disabled to prevent it from being logged into, and yeah - Just in the standard AD Users OU.

[CHiLL]

Our "krbtgt" user is disabled and seemingly cannot be reenabled.

[Koldov]

Quick internet search says OU* is irrelevant.

 

https://www.reddit.com/r/sysadmin/comments/yyp1s6/krbtgt_user_was_moved_into_another_ou_issues/

 

*Depending on if you have anything that looks for an account in a specific OU, like a password change script.

[HarkNowHear]

Can leave it disabled, but remember to reset the password regularly - use one of the MS scripts to manage the process. 

[Jaan]

Here's veeams take on it. 

 

https://community.veeam.com/blogs-and-podcasts-57/reset-the-kbrtgt-account-password-8842

[mrstrong]

Phew, thanks all 

 

I'd been disabling accounts and moving them e.g. 

Get-ADUser -Filter {(Enabled -eq $False)} | Move-ADObject -TargetPath "OU=Disabled,OU=Accounts,DC=ourdomain,DC=local"

so it was probably already disabled and just got moved

I'll move it back 

 

Edited June 26, 2025 by mrstrong

[ITGuyNW]

Yeah it stays disabled. Its there as a background thing. 

 

You should be cycling the keys every six months for security.

[Olliedawg]

Just checked ours and the last change date was 2006... jeez adding that to the job list

[Davit2005]

59 minutes ago, mrstrong said:

Phew, thanks all 

 

I'd been disabling accounts and moving them e.g. 

Get-ADUser -Filter {(Enabled -eq $False)} | Move-ADObject -TargetPath "OU=Disabled,OU=Accounts,DC=ourdomain,DC=local"

so it was probably already disabled and just got moved

I'll move it back 

 

The command is filtering for disabled users i.e. Enabled -eq $False . So in it self not disabling the account. A more safer option would be to set OUs i.e. Service Accounts, Staff Accounts, Student Accounts etc and filter on the OUs that contain those users and not any user in AD otherwise you could end up in a right mess.

Edited June 26, 2025 by Davit2005

[CrootUK]

Just remmber when you change the password which you can just do through aduc to leave it 24 hours before doing the next change. (Two changes are needed to expire all existing tokens) 

Edited June 26, 2025 by CrootUK