Change Kerberos domain account password –

In a hybrid environment, resetting the krbtgt password does not affect Microsoft Entra ID (formerly Azure AD) or cloud authentication, as Kerberos is strictly local to your on-premises Active Directory. However, it will affect any hybrid services that rely on local Active Directory authentication (like on-premises Exchange or local file shares) if the rotation isn’t staggered correctly.

Step-by-Step Routine Rotation Procedure

Because this is a routine rotation, you will execute Step 1 today, wait a full day, and execute Step 2 tomorrow.

Phase 1: Pre-Checks (Execute Today)

Before changing anything, ensure your two Domain Controllers (DCs) are healthy and actively replicating. Run this in PowerShell as an Administrator:

powershell

# Verify replication status between your two DCs
repadmin /replsummary
repadmin /showrepl

Use code with caution.

Do not proceed if you see errors in the replication output.

Phase 2: The First Password Reset (Execute Today)

Microsoft provides a heavily tested, automated PowerShell script explicitly designed for this task: the New-KrbtgtKeys.ps1 script (originally authored by Jorge de Almeida Pinto).

1. Download and run the script in Validation Mode first to ensure no hidden issues exist:powershell.\New-KrbtgtKeys.ps1 -Mode Validation Use code with caution.
2. Run the script in Reset Mode to change the password the first time:powershell.\New-KrbtgtKeys.ps1 -Mode Reset Use code with caution.

Note: If you choose to do this manually via Active Directory Users and Computers (ADUC) instead of the script, simply locate the krbtgt account in the Users container, right-click, choose Reset Password, and assign a complex, random password.

Phase 3: The Wait Period (Crucial)

Wait 10 to 24 hours. Because Active Directory stores the current password and the previous password, your two DCs will still honor all existing user tickets using the previous password. This prevents any user disconnects or authentication prompts.

Phase 4: The Second Password Reset (Execute Tomorrow)

After waiting a full day (ensuring all old tickets have naturally expired and replication has completed between your two DCs):

1. Run the script in Reset Mode a second time:powershell.\New-KrbtgtKeys.ps1 -Mode Reset Use code with caution.

This second reset pushes the password you created yesterday into the “previous” slot, and completely flushes the old password that existed before you started the rotation.

Hybrid Environment Impact Checklist

While cloud authentication is safe, verify the following on-premises hybrids:

• Entra Connect / Azure AD Connect: The sync service account uses standard AD authentication or a managed service account. It will naturally get a new ticket without intervention.
• Azure Application Proxy / Seamless SSO: If you have Azure AD Seamless SSO enabled, it creates a separate computer account in your AD named AZUREADSSOACC. Rotating the krbtgt password does not rotate the Seamless SSO key. Microsoft recommends rotating the AZUREADSSOACC key every 30 days via a separate PowerShell script, which you can safely do right after finishing your krbtgt rotation.