GPO configuration to reset the krbtgt password in a safe way and mitigate golden ticket impact. This script ensures the KRBTGT password is updated securely and consistently across the domain, while also checking for replication issues and logging relevant events.
Does not required a user account as the task will be executed with SYSTEM privilege on a domain controller. It is scheduled by GPO and applied to the domain controllers OU, but only the DC with the PDC FSMO role will execute the task.
Instructions: All operation requires domain admins privilege. The script file should be stored in a location that is only writeable by domain admins. Since the SYSVOL exists for that purpose and it is replicated, we will use this.
*** Always use the DFS name of the sysvol for the script location ***
In the screen capture, the path is WRONG as it is using the server name path:
\\lab1-dc1.lab1.local\netlogon\...
It should be domain FQDN only:
\\lab1.local\netlogon\..
You can adapt the script to your kerberos lifetime, by default it is 10 hours. The current configuration prevent a password change within 12 hours of the last password set time via the variable:
$krbTGTMinTime = (Get-Date).AddHours(-12)
Copy the file to the NETLOGON folder.
Create a new GPO under the Domain controllers OU.
Disable the User configuration as only computer related settings are implemented.
Create a scheduled task in the Preference section of Computer.
Set the task to run as SYSTEM and run with hih privileges whether user logged or not.
Create a trigger that will fits your needs, daily might be aggressive but I would recommend it if a breach is suspected.
Weekly for normal operations.
Daily for a breached or assumed breached scenario
For the actions section select start a program.
Command
%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe
Arguments (replace with your script file location, use FQDN path if the location is on the network like the NETLOGON share).
-noprofile -noninteractive -windowstyle hidden -ep bypass -file "\\lab1-dc1.lab1.local\NETLOGON\krbtgt_reset.ps1"
Optionnaly you can add a check to make sure powershell is available.
"%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe"
Report of the GPO configuration for validations.
The logs are visible in the Event log under Application, here's a few examples:
Password change successful
Password is too recent to be changed
The DC is not the PDC
SHA256 for version 1:
f7019a195ec57068fdc8afdf60734ae8ac71609eb36aeecee8f28d896176925f krbtgt_reset.ps1
62271109dcd91ecdf7e84b8b0c73aa028f36272d352b42b96fb82faa81cbdf48 ScheduledTasks.xml
The password generation functions have been borrowed from:
https://github.com/microsoftarchive/New-KrbtgtKeys.ps1/blob/master/New-KrbtgtKeys.ps1