KRBTGT Account should be added to protected groups and should we enable the AES 256 to this account?

[g461571]

Hello All,

As we know the krbtgt account is created during the domain creation, Can we add the KRBTGT Account should be added to protected groups and should we enable the AES 256 to this account?

[#2]

Hello,
only the password change recommend, it is possible after server 2008 version.
You can read more here: https://adsecurity.org/?p=483