Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Reset the KRBTGT password twice, with at least 10 hours between resets by default, and do it only after you have contained the attacker and planned for reauthentication and replication effects. A single reset leaves the previous key in KRBTGT’s two-password history, so a compromised key may remain usable. The second reset removes that older value. If your domain permits user or service tickets to live longer than 10 hours, wait longer than that configured maximum.
What a Golden Ticket compromise means
KRBTGT is the Active Directory account whose key is used by the Kerberos Key Distribution Center (KDC) to validate ticket-granting tickets (TGTs). If an attacker obtains the KRBTGT secret, they can forge TGTs—commonly called Golden Tickets—that claim broad domain privileges. Those forged tickets can remain useful even after ordinary user passwords are changed, because the attacker is abusing the domain’s ticket-signing key rather than a particular user account.
Changing KRBTGT is therefore an incident-recovery operation, not routine password maintenance. Microsoft’s forest-recovery guidance says to perform the reset twice and wait 10 hours between resets under its default ticket-lifetime assumptions. The interval is not an arbitrary superstition: it gives existing tickets time to expire and lets the directory converge before the next key change.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Why two resets are required
Active Directory retains the two most recent KRBTGT passwords. Kerberos can use the current key and the previous key while tickets issued with the former value age out. A first reset makes a new current key, but the potentially stolen key becomes the previous key. An attacker who already possesses that old key may still forge tickets that validate against a domain controller holding the old value.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
The second reset creates another new key and pushes the compromised value out of the two-password history. Microsoft’s documented wording is: “You should perform this operation twice. You must wait 10 hours between password resets.” Treat that as the baseline procedure, not as permission to shorten the interval based on an informal forum suggestion.
Contain the compromise before touching KRBTGT
A KRBTGT reset cannot evict an attacker who still controls a domain administrator account, a domain controller, replication credentials, scheduled task, service, or other persistence mechanism. Microsoft’s field guidance recommends closing back doors first. Otherwise, an intruder can simply obtain the new key or recreate privileged access after the reset.
Preserve evidence and establish scope
- Preserve domain-controller, authentication, endpoint, and network evidence according to your incident-response process.
- Identify which domains are affected and whether any writable domain controller or replication path was compromised.
- Determine whether the attacker had Domain Admin, Enterprise Admin, delegated replication, backup, or equivalent rights.
- Record current ticket-lifetime settings, replication health, domain-controller inventory, and critical Kerberos-dependent applications before making changes.
Remove persistence and recover privileged identities
Disable or remove unauthorized accounts, groups, services, scheduled tasks, federation integrations, remote-management access, and other persistence. Reset privileged administrative credentials as part of the wider recovery plan. If user accounts may have been exposed, plan user-password resets; if a trust relationship may have been compromised, include trust-password rotation. These actions are separate from the KRBTGT operation and should be sequenced through your incident commander and identity-recovery plan.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →If an attacker still has control of a domain controller or the forest cannot be trusted, stop treating a KRBTGT reset as sufficient containment. Use Microsoft forest-recovery guidance and qualified incident-response support to decide whether a broader forest recovery is necessary.
Confirm the scope and prerequisites
Writable versus read-only domain controllers
The cited Microsoft procedure applies to writable domain controllers on Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Read-only domain controllers (RODCs) have separate, numbered KRBTGT accounts. During RODC recovery, do not delete an RODC’s krbtgt_number account as part of this procedure; follow the RODC-specific recovery instructions instead.
Choose an incident window
Inventory services that use Kerberos, application servers, scheduled jobs, middleware, file services, database connections, and non-Windows clients. A reset can cause clients and applications to request fresh tickets at the same time. Arrange coverage from service owners, help-desk staff, and directory administrators, and define a rollback or escalation path before the first reset. There is no ordinary password-reset rollback that restores a compromised key safely; recovery means completing the planned sequence and addressing any resulting service issue.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Check the password-filter condition
Microsoft warns that a customized password filter, including a modified passfilt.dll, can cause an error during the reset. If your environment uses a nonstandard password filter, review Microsoft Knowledge Base article 2549833 and your filter vendor’s recovery guidance before starting. Do not weaken a security filter blindly in production; coordinate any required change with change control and incident response.
Calculate the safe interval between resets
Microsoft’s default maximum lifetime for user and service tickets is 10 hours, which is why its forest-recovery procedure specifies a minimum 10-hour wait. Your effective minimum is longer if either ticket lifetime is configured above that value. Inspect the domain’s Kerberos policy and use the larger applicable maximum as the waiting period; the second reset should occur only after that period has elapsed.
| Condition | Minimum planning rule | Reason |
|---|---|---|
| User and service ticket maximums are the Microsoft defaults | Wait at least 10 hours | Matches the documented default lifetime and reset interval. |
| Either configured maximum is longer than 10 hours | Wait longer than the largest configured maximum | Existing tickets may remain valid beyond the default window. |
| Replication is unhealthy or has not converged | Do not start the second reset; restore convergence first | Different controllers could hold different KRBTGT keys. |
| Active attacker access remains | Pause and continue containment or begin forest recovery | A reset alone cannot keep a present attacker out. |
Use a timestamped change record for both resets. The interval is measured between completed password changes, not between planning meetings or help-desk notifications.
Do not confuse ticket expiration with instant revocation. Tickets already issued under an earlier key can continue to work until their configured lifetime ends, while controllers and clients transition to the newer key. That is why a planned wait and controlled validation are safer than an immediate second change followed by a mass restart. If the domain has different policies for user and service tickets, plan against the longer applicable value.
Step-by-step: reset KRBTGT safely
1. Open Active Directory Users and Computers
Use an authorized administrative workstation or management host with a secure connection to the affected domain. Confirm that you are operating in the intended domain; a forest may contain multiple domains, and each affected domain requires its own recovery decision.
2. Enable Advanced Features
- Open Active Directory Users and Computers.
- In the console menu, select View and enable Advanced Features.
- Expand the domain and open the built-in Users container.
- Locate the domain’s
krbtgtuser account. Verify the account and domain carefully before changing anything.
3. Perform the first password reset
- Right-click
krbtgtand choose Reset Password. - Complete the reset confirmation. The password you type is not significant: Windows generates the strong KRBTGT password independently.
- Do not enable the account or change unrelated properties while performing this operation.
- Record the completion time and the domain controller that processed the change.
Allow the new value to replicate. Monitor directory-service events and replication status rather than assuming that a successful dialog means every controller has converged.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
4. Wait the full interval
Wait at least 10 hours when the default ticket-lifetime policy applies. If your configured user or service ticket maximum is longer, wait beyond that value. During this period, watch for replication failures, authentication errors, unusual ticket activity, and signs that the attacker still has access. Do not use a shorter interval merely because some clients appear healthy.
5. Perform the second reset
- Return to the same domain’s Users container in Active Directory Users and Computers.
- Right-click
krbtgtand select Reset Password again. - Record the second completion time and verify that the reset succeeded.
This second change moves the originally compromised password out of the two-password history. It does not by itself reset user passwords, trust passwords, service-account secrets, or credentials stored on domain controllers.
6. Allow convergence and ticket renewal
Give the second change time to replicate throughout every writable domain controller in the affected domain. Clients may continue using tickets issued under an earlier key until those tickets expire, while new authentication requests should obtain tickets signed with the current key. Avoid forcing a simultaneous restart of every system unless your incident plan specifically requires it; uncontrolled restarts can create a larger authentication surge.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches7. Validate the recovery
- Confirm successful replication among writable domain controllers.
- Review Kerberos, KDC, directory-service, and system event logs for errors or unexpected activity.
- Test interactive logon, service-to-service authentication, file access, scheduled jobs, and other critical workflows.
- Verify that representative Windows and non-Windows clients can obtain fresh tickets.
- Continue hunting for persistence and forged-ticket activity; a clean reset result is not proof that the incident is closed.
Build a practical validation plan
Validation should happen in stages rather than as one pass/fail test. Immediately after each reset, confirm that the administrative operation completed and that the change is visible through directory monitoring. Before the second reset, verify that writable controllers have converged and that there is no unresolved replication error. After the second reset, test a small, representative set of users, servers, scheduled tasks, and application paths before declaring the incident window complete.
- Directory layer: compare replication health and confirm that every writable controller in the affected domain has received both changes.
- Authentication layer: test a new interactive logon and a new service authentication request, then review Kerberos and KDC logging for failures.
- Application layer: have service owners test file shares, databases, middleware, batch jobs, and other workflows that rely on Kerberos.
- Client layer: include Windows and non-Windows systems, remote sites, and systems that maintain long-lived connections.
- Security layer: continue looking for unauthorized privileged access, forged-ticket activity, and persistence even when routine logons succeed.
Keep the first and second completion timestamps, the domain and controller involved, observed replication status, ticket-lifetime assumptions, test results, and unresolved exceptions in the incident record. This makes it possible to distinguish a delayed ticket renewal from a failed reset and gives the next responder a reliable handoff.
What users and services may experience
Microsoft reports that Active Directory-dependent applications may need to authenticate again after KRBTGT rotation. A large number of simultaneous requests can increase demand on LSASS and domain controllers. Plan capacity and stagger nonessential reconnects where the application permits it.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Some non-Windows clients may not immediately request a new ticket while an existing ticket remains valid. They can therefore behave differently from Windows clients during the transition. If one platform fails while another succeeds, check its Kerberos cache, clock synchronization, service-principal configuration, and client-specific renewal behavior before assuming that the reset was incorrect.
Free tools Windows power users keep installed
One-click scans. No signup required.
Symptoms that warrant investigation
- New logons fail across multiple sites: check replication, DNS, time synchronization, and domain-controller health.
- Only one application fails: inspect its service account, SPN, connection pool, and ticket-renewal handling with the application owner.
- Failures are concentrated on non-Windows systems: verify that the client can discard or renew cached tickets and that its Kerberos implementation supports the domain’s current settings.
- Errors continue after the configured ticket lifetime has passed: investigate replication divergence or remaining attacker control rather than repeating resets immediately.
Common mistakes to avoid
- Resetting only once: the compromised value remains the previous KRBTGT password.
- Waiting exactly 10 hours when policy is longer: 10 hours is the default reference, not a universal maximum.
- Resetting while persistence remains: an attacker with privileged access can regain the new key or create another path.
- Ignoring replication: a controller that has not received the change can produce inconsistent authentication results.
- Deleting RODC numbered accounts: RODC recovery has different requirements; preserve those accounts.
- Changing the typed password repeatedly: Windows generates the strong KRBTGT value; the operator’s chosen text is not the security control.
- Assuming all clients renew identically: non-Windows and application-specific behavior can delay recovery.
- Treating KRBTGT as the whole recovery: privileged, user, service, trust, and domain-controller credentials may also require action.
When a broader forest recovery is necessary
Escalate beyond a normal two-reset sequence when the attacker retains administrative control, domain-controller integrity is uncertain, replication cannot be trusted, or you cannot identify and remove persistence. Microsoft’s forest-recovery guidance covers rebuilding trust in the directory, resetting administrative credentials, and deciding whether user and trust passwords must also change. A KRBTGT rotation is one control within that process, not a substitute for rebuilding a compromised identity foundation.
For a systemic identity compromise, involve your organization’s incident commander and qualified Microsoft or specialist incident-response support. Keep the scope explicit: the objective is to restore a trustworthy authentication system while preserving evidence and maintaining critical services.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Operational decision checklist
| Question | If yes | If no |
|---|---|---|
| Have persistence and unauthorized privileged access been removed? | Proceed to recovery planning. | Continue containment before resetting KRBTGT. |
| Are all affected domains and writable DCs identified? | Map each domain’s reset and validation tasks. | Complete scoping first. |
| Are ticket maximums known? | Set the interval above the largest configured value. | Use the documented 10-hour default only after verifying that policy assumptions apply. |
| Is replication healthy? | Schedule the first reset. | Repair or isolate the directory issue before proceeding. |
| Are service owners and non-Windows client owners prepared? | Run the reset in the approved incident window. | Complete impact planning and escalation coverage. |
Sources and applicability
The reset steps, two-password explanation, 10-hour minimum, supported Windows Server versions, password-filter warning, and RODC exception come from Microsoft’s Active Directory forest-recovery guidance (2025). Microsoft’s field FAQ documents the broader recovery context, LSASS and reauthentication risks, and non-Windows client caveats. CISA and NSA/CSS guidance reinforces treating identity compromise as a wider recovery problem. Policies and behavior can differ by domain configuration, client implementation, and incident scope, so record those variables in your recovery plan.
Frequently Asked Questions
Do I really need to reset KRBTGT twice?
Yes. Active Directory retains the two most recent KRBTGT passwords. The first reset makes the compromised value the previous password; the second pushes it out of that two-password history.
Can I perform the second reset after less than 10 hours?
Not under Microsoft’s documented default procedure. Wait at least 10 hours, and wait longer when the configured maximum user or service ticket lifetime exceeds 10 hours.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
What happens to end users if the rotation goes wrong?
Users and applications may need to authenticate again, and a surge of requests can increase LSASS and domain-controller demand. Some non-Windows clients may continue using an existing ticket until it expires instead of requesting a new one immediately.
Does changing KRBTGT reset every other password?
No. It changes only the domain’s KRBTGT secret. Privileged administrator, user, service-account, trust, and domain-controller credentials require separate recovery decisions.
Should I reset KRBTGT while an attacker may still control a domain administrator account?
No. First remove persistence and unauthorized privileged access, or move to a broader forest-recovery plan. An attacker who remains present can obtain the new key or recreate access.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchDoes this procedure apply to a read-only domain controller?
The cited procedure is for writable domain controllers. RODCs use separate numbered KRBTGT accounts; do not delete a krbtgt_number account during RODC recovery.
What if the reset fails with a password-policy or filter error?
A customized password filter, including a modified passfilt.dll, can cause an error. Review Microsoft KB 2549833 and the filter vendor’s recovery guidance before changing the filter.
Is the password I type during Reset Password important?
No. Windows generates the strong KRBTGT password independently. Record the operation and verify replication rather than trying to select or reuse a particular text value.
How do I know the second reset has taken effect everywhere?
Check replication health across every writable domain controller in the affected domain, review directory-service and authentication logs, and test fresh logons and critical Kerberos-dependent services from representative clients.
The Bottom Line
Contain first, then reset KRBTGT twice. Use Microsoft’s 10-hour minimum between resets when default ticket lifetimes apply, wait longer for larger configured lifetimes, protect RODC-specific accounts, verify replication, and prepare service owners for renewed authentication. If persistence, domain-controller integrity, or forest trust remains in doubt, escalate to broader forest recovery rather than treating KRBTGT rotation as a complete fix.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
