Monitor that checks the pwdLastSet attribute of the krbtgt account and compares it to a threshold for age. The pwdLastSet attribute marks the date that the password was last set.

Resetting the krbtgt account password is a security best practice. A stolen krbtgt account password can wreak havoc on an organization because it can be used to impersonate authentication throughout the organization thereby giving an attacker access to sensitive data.

One way to help mitigate the risk of a bad actor using a compromised krbtgt key to forge user tickets is by periodically resetting the krbtgt account password. Resetting this password on a regular basis reduces the useful lifetime of krbtgt keys, in case one or more of them is compromised.

Possible causes include the following:

• Password age of the krbtgt account has exceeded the threshold.

Reset the password of the krbtgt account.

• Guide for resetting the KRBTGT account password