KRBTGT Account should be added to protected groups and should we enable the AES 256 to this account?

%3CLINGO-SUB%20id%3D%22lingo-sub-1856765%22%20slang%3D%22en-US%22%3EKRBTGT%20Account%20should%20be%20added%20to%20protected%20groups%20and%20should%20we%20enable%20the%20AES%20256%20to%20this%20account%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1856765%22%20slang%3D%22en-US%22%3E%3CP%3EHello%20All%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAs%20we%20know%20the%20krbtgt%20account%20is%20created%20during%20the%20domain%20creation%2C%20Can%20we%20add%20the%26nbsp%3BKRBTGT%20Account%20should%20be%20added%20to%20protected%20groups%20and%20should%20we%20enable%20the%20AES%20256%20to%20this%20account%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1856765%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EActive%20Directory%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EWindows%20Server%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1865250%22%20slang%3D%22en-US%22%3ERe%3A%20KRBTGT%20Account%20should%20be%20added%20to%20protected%20groups%20and%20should%20we%20enable%20the%20AES%20256%20to%20this%20acco%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1865250%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%3CBR%20%2F%3Eonly%20the%20password%20change%20recommend%2C%20it%20is%20possible%20after%20server%202008%20version.%3CBR%20%2F%3EYou%20can%20read%20more%20here%3A%20%3CA%20href%3D%22https%3A%2F%2Fadsecurity.org%2F%3Fp%3D483%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fadsecurity.org%2F%3Fp%3D483%26nbsp%3B%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

Hello All,

 

As we know the krbtgt account is created during the domain creation, Can we add the KRBTGT Account should be added to protected groups and should we enable the AES 256 to this account?

1 Reply
Highlighted

Hello,
only the password change recommend, it is possible after server 2008 version.
You can read more here: https://adsecurity.org/?p=483