Active Directory User Account -- krbtgt

[Rosee]

We have just upgraded Windows 2000 server from NT.

From active directory, there is an user account named "krbtgt" with the description "key distribution center service account". What is this? What does this account use for? I don't have anyone using this one as userID. Can I disable it or delete it?

If you know anything about it, please share with me. Thanks a lot.

 

[kev01]

The Windows 2000 Server uses the KRBTGT account as part of Kerberos authentication.

This account is disabled on Domain Controllers by default.

Unlike other user accounts, the krbtgt account cannot be used to log on to the domain and in fact, cannot be enabled

check out:

http://www.microsoft.com/technet/tr...technet/security/issues/W2kCCSCG/W2kSCGcd.asp

Hope this helps,
kev

 

[GrnEyedLdy]

Rosee,

a little more info...

http://mailman.mit.edu/pipermail/kerberos/2002-April/000711.html

"The security principal name used by the KDC in all Windows 2000 domains is krbtgt, as specified by RFC 1510. An account for this security principal is created automatically when a new Windows 2000 domain is created. The account cannot be deleted, nor can the account name be changed. A password is assigned to the KDC's account automatically;
this password, like the passwords assigned to domain trust accounts, is changed on a regular schedule. The password for the KDC's account is used to derive a secret key for encrypting and decrypting the TGTs that the KDC issues".


Patty

 

[Rosee]

Thanks all.

But the following was the message that I got from Event Viewer Security Log this morning:

Service Ticket Request Failed:
User Name:
User Domain:
Service Name: krbtgt/CMHHS.ORG
Ticket Options: 0x2
Failure Code: 0x20
Client Address: 127.0.0.1

It happened at 1:30AM last night with logon failed. What does this message try to tell me? If this one is disabled by default, why did it try to logon during night?

 

[machoo]

I have recieved similar messages on my network. and while things seem to run normally anyway, I was wondering if this is something I should be concerned about.