Recommended Free Tools
Reset the domain’s krbtgt password twice, with at least 10 hours between resets by default (longer if your ticket-lifetime policy is longer). Do this only after containing the attacker, checking domain-controller and replication trust, and planning for renewed authentication across dependent services. The Microsoft procedure applies to writable domain controllers; read-only domain controllers (RODCs) require separate recovery handling.
Why a Golden Ticket requires KRBTGT rotation
Kerberos uses the domain’s krbtgt account key to sign and validate ticket-granting tickets (TGTs). If an attacker extracts that key or hash, the attacker can forge a Golden Ticket that appears legitimate to domain controllers. Such a ticket can be created with broad domain privileges and an extended lifetime, allowing access even after ordinary user-password changes.
As an Amazon Associate I earn from qualifying purchases.
Changing the account password once does not immediately remove every old KRBTGT key. Active Directory retains the two most recent password values so that tickets issued with the previous key can continue to be validated during normal rollover. A second reset moves the originally compromised value out of that two-password history. That is why Microsoft’s forest-recovery guidance requires two resets rather than one.
“You should perform this operation twice. You must wait 10 hours between password resets.”
#1 Best Overall
Sale
TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for AI Calls,Immersive Premium Sound Bass Headset with Charging Case,32 EQ via App Black
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
The two-reset sequence is therefore an invalidation procedure, not merely a password change. The first reset introduces a new key while the previous key remains available for validation. The second reset retires the old value from the two-password window. It does not erase every ticket instantly, undo unrelated credential theft, or repair a domain that an adversary still controls.
When to rotate—and when not to start yet
KRBTGT rotation is a recovery action, not a substitute for containment. Microsoft’s field guidance warns that resetting the account while an attacker still has administrative access does not keep that attacker out: the adversary could regain the new key, create another ticket, or use a different persistence mechanism.
Complete these containment tasks first
- Preserve relevant evidence and document the suspected compromise window.
- Remove back doors, unauthorized scheduled tasks, malicious services, web shells, delegation changes, and other persistence discovered during triage.
- Determine whether any domain controller, virtualization host, backup system, or replication credential was compromised.
- Identify every affected Active Directory domain, including trusts and child domains that may require separate recovery actions.
- Prepare a wider identity-recovery plan for privileged accounts, service accounts, user accounts, and trust passwords when the breach warrants it.
If the attacker still controls a domain controller or equivalent administrative path, involve qualified incident-response personnel and follow a forest-recovery plan instead of treating two password resets as a complete fix. The decision to delay is not permission to leave the key exposed indefinitely; it is a way to ensure that the new key will not immediately be stolen again.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsQuestions to answer before scheduling
- Which domain or domains actually suffered the compromise?
- Are all writable domain controllers reachable, replicating, and monitored?
- What are the configured maximum lifetimes for user and service tickets?
- Which applications, automation jobs, databases, file services, and remote sites depend on Kerberos?
- Which non-Windows clients, appliances, or embedded systems may handle ticket renewal differently?
- Who can respond if a service prompts for credentials or fails after the second reset?
Confirm the domain and controller scope
The cited Microsoft procedure covers writable domain controllers running Windows Server 2016, 2019, 2022, or 2025. In a multi-domain forest, assess and plan each affected domain; a reset in one domain does not rotate the KRBTGT account in another.
Writable domain controllers
Use the documented reset procedure against the domain’s normal Active Directory administration path. Ensure replication is functioning so the new password values can converge to all writable domain controllers before you rely on the result. A client that reaches a controller that has not received the change can observe different ticket-validation behavior from a client reaching a fully converged controller.
Read-only domain controllers
Do not delete an RODC’s krbtgt_number account during RODC recovery. Those accounts are specific to RODC credential handling and are covered by separate recovery guidance. Treat an RODC compromise as a distinct recovery workstream rather than applying the writable-DC steps indiscriminately. Record which RODCs exist and which sites depend on them so that local administrators do not mistake an RODC-specific account for the domain’s normal krbtgt user.
Multiple domains and trusts
Each affected domain has its own KRBTGT account and its own reset sequence. A forest-wide incident may also require administrative, user, service, and trust-password changes. Trust rotation is a separate decision from KRBTGT rotation; include it when the breach assessment indicates that trust credentials or the partner domain could have been exposed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Plan the service and client impact
Rotating KRBTGT keys changes how new and existing Kerberos tickets are validated. Microsoft reports that Active Directory-dependent applications may need to authenticate again, that a reauthentication surge can increase demand on the Local Security Authority Subsystem Service (LSASS), and that some non-Windows clients may not request a fresh ticket until an existing ticket expires. These are documented risks, not guaranteed failures in every environment.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
| Planning factor | What to check | Why it matters |
|---|---|---|
| Ticket lifetime | Configured maximum lifetimes for user and service tickets | The default interval assumes a 10-hour maximum; a longer policy requires a longer wait between resets. |
| Replication | Health and convergence across all writable domain controllers | A reset that has not replicated everywhere can produce inconsistent ticket validation. |
| Kerberos-dependent services | File services, application servers, databases, automation, and scheduled jobs using domain authentication | These systems may request new tickets or prompt for authentication during recovery. |
| Client mix | Windows, Linux, Unix, appliances, and embedded clients | Non-Windows implementations can differ in when they discard or renew tickets. |
| Operational window | Service-owner coverage, help-desk staffing, monitoring, and rollback communications | Two resets can create a concentrated authentication workload and user reports. |
Schedule the operation as an incident change. Record the exact time of the first reset, the policy value that determines the waiting period, and the time authorized for the second reset. Do not shorten the interval because a forum or an informal procedure suggests that tickets might expire sooner.
Choosing the interval in a real environment
Microsoft Learn’s 2025 forest-recovery guidance uses 10 hours as the default maximum lifetime for user and service tickets and sets the minimum inter-reset wait at 10 hours. If either configured maximum is longer, use the larger applicable value and wait longer than that value. The point is to allow tickets issued under the first key to age out under the policy actually enforced in your domain.
Replication and ticket lifetime answer different questions. Ticket lifetime determines how long a previously issued ticket may remain valid; replication determines when every writable controller knows the new key. Confirm both. If the incident plan calls for extra time to verify convergence or to staff service owners, that operational buffer is additional to the policy-based minimum, not a replacement for it.
Free tools Windows power users keep installed
One-click scans. No signup required.
Step-by-step: perform the two resets
1. Open the domain’s KRBTGT account
- On an administrative workstation or server with the appropriate Active Directory tools, open Active Directory Users and Computers.
- Enable View > Advanced Features.
- Open the domain’s Users container and locate the user account named
krbtgt. - Verify that you are operating in the intended domain and that the account is the domain KRBTGT account, not an RODC-specific
krbtgt_numberaccount.
Use a change record or incident ticket to capture the domain name, operator, controller used for administration, and planned timestamps. This prevents an administrator from resetting the wrong domain during a forest-wide response.
2. Perform the first password reset
- Right-click
krbtgtand choose Reset Password. - Enter and confirm a password that meets the domain’s password policy.
- Complete the reset and record the timestamp.
The password you type is not the security secret you need to manage manually; Windows generates and stores the strong account password independently. Do not attempt to set the same value on another domain controller or distribute the entered text to service owners. Protect the administration workstation and the operator account as carefully as any other privileged recovery asset.
3. Wait for the full interval
Microsoft’s documented default is at least 10 hours between resets because the default maximum lifetime for user and service tickets is 10 hours. If either configured maximum is longer, wait longer than that configured value. Use the larger applicable lifetime when calculating the window, and allow time for replication and operational checks as required by your incident plan.
Do not count from the time someone opened the dialog or from an attempted reset. Count from the confirmed completion of the first successful reset. Record the policy value and the resulting earliest second-reset time so that the incident team, service owners, and on-call staff share the same schedule.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →4. Perform the second password reset
- After the calculated interval has elapsed, return to Active Directory Users and Computers.
- Repeat Reset Password for the same domain
krbtgtaccount. - Record the second-reset timestamp and retain the change evidence with the incident record.
The second reset removes the previously compromised value from the account’s two-password history. It does not, by itself, remove an attacker who still has domain control or invalidate unrelated credentials that were stolen during the compromise.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
What users and services may experience
Renewed authentication
Applications that use Kerberos can request new tickets after the key changes. Users may see a sign-in prompt, a reconnect request, or a brief interruption when an application renews its credentials. Service owners should know in advance how to restart or reauthenticate their applications. A prompt is not proof that the rotation failed; it can be a normal consequence of ticket renewal.
Authentication load
A large number of clients renewing tickets at once can increase LSASS and domain-controller workload. Watch capacity during and after each reset, particularly in environments with many application servers, automated jobs, or remote sites that depend on a small number of domain controllers. Coordinate monitoring with the people who can distinguish an expected reauthentication spike from an attack or a replication fault.
Non-Windows ticket behavior
Some non-Windows clients may continue using an existing ticket until it expires instead of immediately requesting a replacement. This can make the transition appear uneven: one service may recover quickly while another continues to fail or recover only after its cached ticket lifetime ends. Work with the client owner to restart the relevant process or obtain a new ticket using that platform’s supported procedure. Avoid deleting arbitrary credential caches without documenting the action and understanding the client’s supported recovery method.
What should end users be told?
Give users a concise notice that some applications may request sign-in again and that intermittent access problems should be reported with the application name, time, and client type. Do not distribute the KRBTGT password or imply that users should change their own passwords solely because the account was rotated. Broader user-password changes belong to the compromise assessment and recovery plan.
Troubleshoot common problems
The reset reports a password-filter error
Microsoft warns that a customized password filter, including passfilt.dll configurations, can cause an error during KRBTGT reset. Review the filter’s policy and the Microsoft-documented workaround in KB 2549833 before retrying. Do not bypass the filter by weakening domain password controls during an active compromise. Preserve the error details and involve the team that owns the filter so that a workaround does not create a second security problem.
Authentication fails only on some servers
- Check replication health and confirm that both resets have reached every writable domain controller that clients can contact.
- Check whether the affected application is using Kerberos, cached credentials, or a service account with an independent password.
- Restart or reauthenticate the affected service according to its vendor-supported process.
- For non-Windows systems, verify that the client has discarded an old ticket and can obtain a new one.
- Compare the failure times with the first and second reset timestamps and with any controller or site outage.
The second reset was started too soon
Do not assume that a shorter delay is safe. Recalculate the interval from the configured maximum user and service ticket lifetimes, then coordinate with the incident lead. If the timing or replication state is uncertain, document the uncertainty and obtain Microsoft or qualified incident-response guidance rather than improvising a schedule. The safest response depends on the actual policy, the keys currently retained, and whether an attacker remains active.
The attacker remains active
Stop treating the operation as complete. Isolate compromised systems, remove the remaining access path, and escalate to forest-recovery procedures if domain trust cannot be established. A new KRBTGT key is not effective against an attacker who can acquire the replacement key or create new privileged credentials.
A service still fails after both resets
Separate ticket problems from unrelated credential problems. Confirm that the service is using the intended domain, that its account is not disabled or otherwise misconfigured, and that the client can reach a functioning controller. Then check for stale tickets, application-specific caches, replication failures, and service-account exposure. If the service’s credentials were stolen during the compromise, reset them as part of the broader recovery rather than expecting KRBTGT rotation to repair them.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Validate the recovery
Validation should cover both directory state and the services that matter to the business. Keep evidence of each check and its time.
- Confirm that both password resets completed successfully for the intended domain.
- Verify replication convergence across writable domain controllers and investigate any replication failures before declaring success.
- Monitor Kerberos and directory-service events for ticket-validation errors, authentication spikes, or continuing anomalous activity.
- Test representative user logons, administrative logons, service-account authentication, and ticket acquisition from the client types used in the environment.
- Have application owners verify scheduled jobs, file access, database connections, APIs, and other Kerberos-dependent functions.
- Continue hunting for forged tickets, persistence, unauthorized delegation, new privileged accounts, and other indicators of compromise.
Validation should be repeated after the second reset, not only immediately after the first. Include remote sites and systems that authenticate infrequently, because a client that was offline during the change may reveal a problem later. Keep the replication results, monitoring observations, service-owner confirmations, and exceptions in the incident record.
Continue the identity recovery beyond KRBTGT
Microsoft forest-recovery guidance treats KRBTGT rotation as one control in a broader recovery. Reset administrative credentials and evaluate user-account resets when those accounts may have been exposed. Assess trust relationships and rotate trust passwords when the breach warrants it. Service-account credentials, backup credentials, and credentials stored on compromised domain controllers or management hosts may also require replacement.
Document which domains, controllers, accounts, trusts, services, and client populations were included. Preserve the reset times, replication evidence, monitoring results, and exceptions such as RODCs. This record allows responders to prove which keys were retired and to identify systems that still need remediation.
CISA and NSA/CSS guidance similarly treats a domain compromise as an identity-recovery problem rather than a single-account maintenance task. If the environment cannot be trusted, use the organization’s forest-recovery process and qualified incident-response support. Microsoft Incident Response may be relevant for a systemic identity compromise, but any engagement, pricing, or partnership terms must be verified separately.
Operational decision checklist
- Containment and evidence preservation are complete enough to prevent immediate re-compromise.
- The affected domains and writable versus read-only controllers are identified.
- Ticket-lifetime settings have been checked; the waiting period is based on the longest applicable value.
- Kerberos-dependent services, non-Windows clients, and service owners have been inventoried.
- A maintenance window, monitoring plan, and user-support process are ready.
- The first reset has replicated and its timestamp is recorded.
- The second reset is performed only after the required interval.
- Authentication, replication, dependent services, and continuing attacker activity are checked afterward.
- Privileged, service, user, and trust credentials are reviewed as part of the larger recovery.
Sources and applicability
The reset steps, two-reset requirement, default interval, supported Windows Server versions, writable-DC scope, and RODC warning come from Microsoft Learn’s Active Directory Forest Recovery guidance (2025). Microsoft’s field FAQ supplies the operational cautions about persistence, LSASS load, reauthentication, and non-Windows clients. CISA and NSA/CSS guidance corroborate the need for broader identity recovery after a domain compromise. These instructions should be adapted to the organization’s incident-response plan and the actual ticket-lifetime and replication configuration.
Frequently Asked Questions
Why are two KRBTGT resets required?
Active Directory retains the two most recent KRBTGT password values. The first reset adds a new key while the old key remains in history; the second moves the originally compromised key out of that two-password window.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteIs 10 hours always enough between resets?
Ten hours is Microsoft’s documented default minimum because the default maximum lifetime for user and service tickets is 10 hours. If either configured maximum is longer, wait longer than that value.
Will users be logged out immediately?
Not necessarily. Applications may request renewed authentication, and some non-Windows clients may continue using an existing ticket until it expires. Expect possible prompts, reconnects, or brief interruptions rather than a guaranteed universal logout.
Does rotating KRBTGT remove the attacker?
No. Rotation invalidates the compromised key after the two-reset sequence, but it cannot remove an attacker who still controls a domain controller, can steal the replacement key, or has another persistence path.
Can I use the same password on both resets?
The entered text is not the secret you need to distribute; Windows generates and stores the strong account password. Follow the supported reset procedure and do not manually copy a password between controllers.
Can I apply these steps to an RODC?
The cited procedure is for writable domain controllers. Do not delete an RODC-specific krbtgt_number account; use separate RODC recovery guidance.
What if the reset fails because of a password filter?
A customized password filter, including passfilt.dll configurations, can cause an error. Review the Microsoft workaround in KB 2549833 and involve the filter owner rather than weakening password controls.
What should I do if the second reset happened too soon?
Recheck the configured user and service ticket lifetimes, replication status, and incident scope. Document the timing and obtain Microsoft or qualified incident-response guidance instead of assuming that a forum schedule is safe.
The Bottom Line
After containment, reset the writable domain’s krbtgt account twice, waiting at least 10 hours by default—or longer than the longest configured user or service ticket lifetime—between resets. Confirm replication, monitor authentication load, test dependent services and non-Windows clients, and continue the broader forest and credential recovery. Two resets retire a compromised KRBTGT key; they do not replace containment or prove that the domain is trustworthy.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
