Active Directory’s Kerberos implementation trusts whatever the KRBTGT account signs. If an attacker steals that account’s hash, they can mint unlimited “golden tickets” that grant domain admin rights—even after you clean every other system.
Below is an incident‑response playbook that shows how to prove a compromise, invalidate forged tickets, and restore trust without bringing the business to its knees.
1. What Exactly Is a Golden Ticket?
| Aspect | Details |
|---|---|
| Prerequisites | Domain‑controller‑level privileges (e.g., DCSync to dump KRBTGT hash) |
| Weaponisation | Tools such as Mimikatz forge Ticket Granting Tickets (TGTs) signed with the stolen hash |
| Impact | Unlimited, invisible privilege escalation across the forest for up to 10 years (default maximum lifetime of a password‑derived key) Netwrix |
2. First‑Hour Verification Checklist
| Indicator | Where to Look | Why It Matters |
|---|---|---|
| Event ID 4769 surges for high‑value SPNs | Security log on all DCs | Abnormal service‑ticket requests suggest forged tickets LinkedInLinkedIn |
| Event ID 4624 logons from unusual workstations to DCs | Security log | Golden tickets often originate from non‑DC hosts |
| Unscheduled replication traffic (Event ID 4662 on NTDS.dit) | Directory Service log | Attackers may have used DCSync to grab the hash |
Suspicious lsadump::dcsync /user:KRBTGT in PowerShell or EDR telemetry | Endpoint telemetry | Common Mimikatz command to steal the hash Netwrix |
Tip ➜ Export logs immediately; attackers often purge evidence.
3. Planning the KRBTGT Reset
Resetting the password twice is the only way to invalidate every forged ticket. Do it wrong and you could break Kerberos for critical apps.
- Map dependencies – identify smart‑card logons, service accounts, legacy apps that cache TGTs.
- Select a low‑business‑impact window (nights/weekend).
- Warn admins that all users and services will re‑authenticate. Some servers may need reboots. Microsoft Learn
4. Step‑by‑Step KRBTGT Password Reset
| Step | Action | Notes |
|---|---|---|
| 1 | Force AD replication to minimise lingering objects. | repadmin /syncall /AeD |
| 2 | First Reset – change KRBTGT password using “Reset Password” (choose a strong, random value). | Invalidates tickets encrypted with old hash. Microsoft Learn |
| 3 | Wait for convergence across all domain controllers. Verify with repadmin /showrepl. | Don’t rush; stale DCs break logons. |
| 4 | Second Reset – change KRBTGT password again. | Wipes tickets created between reset 1 and replication completion. Microsoft Learn |
| 5 | Purge cached tickets on critical servers (klist purge) or reboot application services. | Some apps cache TGTs in memory. |
| 6 | Monitor logs for fresh 4769/4624 events and failed authentications; investigate anomalies. | Ensures attacker tickets are dead. |
5. Post‑Reset Validation
- Confirm normal user logons succeed.
- Spot‑check Kerberos service tickets on tier‑zero servers:
klist sessions. - Track Secure Score (Defender for Identity) to ensure KRBTGT age is under 180 days. Microsoft Learn
6. Mitigation & Hardening Summary
| Task | Action |
|---|---|
| Patch DCs & tier‑zero workloads | Apply latest cumulative updates. |
| Limit DCSync rights | Ensure only built‑in security principals can replicate secrets. |
| Enable Protected Users / Credential Guard | Blocks ticket caching on workstations. |
| Rotate KRBTGT on a schedule | Industry best practice: every 180–365 days—even without an incident. |
| Deploy real‑time identity sensors | Defender for Identity or similar detects future golden‑ticket attempts. |
Frequently Asked Questions
Is changing KRBTGT once good enough?
No. A single reset only kills tickets encrypted with the oldest key. Attackers can still generate tickets using the key created moments after your first reset.
Will this break trust with external forests?
Trust tickets are re‑signed automatically during replication; external trusts will honour the new keys after DCs converge.
How can I prove the attacker is out?
After the second reset, forged tickets fail decryption, triggering Kerberos errors 0x7A and 0x25. Pair these with failed 4769 events to hunt remaining activity.
Need Immediate Help?
Forestal Security offers:
- 24/7 breach triage & IR support
- Automated KRBTGT reset orchestration
- Managed Defender for Identity deployments
- Post‑incident hardening workshops
Book a free 30‑minute consultation → forestalsecurity.com/contact or call (765) 239‑2250.
