Reset krbtgt twice. Yes, twice
Oct 14th, 2023 by Jesper Kråkhede
The krbtgt account is the account whose password is used to sign every Kerberos ticket granting ticket in your domain. If an attacker gets its password hash, he can create his own tickets, golden tickets, for any user, with any rights, for as long as he likes. Changing the passwords of all admins doesn´t help. The tickets are still valid.
The fix is to reset the krbtgt password. And you need to do it twice. Why?
Because Active Directory keeps the current and the previous password for krbtgt. That is a feature: when you reset the password, tickets already issued with the old key keep working, so users aren´t thrown out. But it also means that a golden ticket made with the old hash keeps working after the first reset. Only after the second reset is the stolen key gone.
But don´t do the two resets right after each other. Wait until the first change has replicated to all domain controllers and the existing tickets have expired, by default ten hours. Otherwise you will break authentication for a lot of users and services. Microsoft has published a script that helps check replication and do it safely.
Do this after every incident where Tier 0 may have been compromised. And do it regularly as maintenance, for example twice a year, so it isn´t the first time you do it in the middle of a crisis.
One reset closes the door. The second one changes the lock.