Posture check · Account security
KRBTGT password older than 180 days (T1558.001)
KRBTGT signs every Kerberos ticket in the domain. Anyone holding its key can forge a ticket for any account (a golden ticket).
Why it matters
A forged ticket stays valid until the KRBTGT password is rotated twice. Until then, a past compromise can still be in use.
How GraphnAI finds it
It runs after every sync, on each connected domain or tenant on its own. It applies to Active Directory.
It reads:
- The directory attributes
pwdLastSetandsAMAccountName
Tiered Fidelity™ level: Theoretical
Every finding from this check carries the Theoretical level.
- TheoreticalThis checkConfigured in the directory. Nothing else checked.
- ConstrainedA constraint on it has been checked.
- ValidatedTelemetry has seen it in use.
Why there's no automatic fix
Every ticket in the domain depends on this key, so the two rotations run as a planned procedure.
How to fix it
Rotate the KRBTGT password twice, at least 10 hours apart. Then put the rotation on a recurring schedule.
MITRE ATT&CK® technique names and MITRE D3FEND™ technique labels: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark and D3FEND™ a trademark of The MITRE Corporation.
See it on your own directory.
The Public Preview is free for 30 days from your first sync, on your own server.