this is susan bradley for cso online today i'm going to talk about resetting the kerberos service
account password this is one of those tasks that if you're a large enterprise you probably
do this on a regular basis if you're like many small to medium businesses you probably haven't
changed this password since your domain infrastructure was initially implemented
when an attacker wiggles into your network one of the attack sequences that they can use
is an attack called the golden ticket attack if the kerberos password hash
is stolen or broken in an attack the attackers can grant themselves full access to your network with
necessary authentication so if you monitor and maintain an active directory infrastructure
this is one of those tasks that you actually need to do on a regular basis
usually twice a year and if you've been or had an intrusion it's something you can immediately
do and you should do it two times quickly and what this does is it breaks the attacker from able to
to use that hash value again so you need to make sure that you have active directory 2008 or higher
uh doing so will not cause replication issues so you have to make sure you're
on that functional level you want to make sure you change the password accounts once
waiting for replication to complete and then you want to do it a second time which provides
a solid process for ensuring the kerberos account is protected if you're in the process of a breach
you want to do it twice in rapid succession before ad replication completes this will invalidate all
tickets forcing clients to re-authenticate you may have to reboot some some application
servers and you may have to reboot domain controllers things like that but again you
want to make sure you do it quickly if you have a breach situation and if you're in a maintenance
situation you want to wait between these password changes waiting for replication to complete
now there's several scripts out there on the web there's many different ways that you can do
the kerberos changing the password so the first thing i'm going to do is i'm going to check and
make sure that my domain is up to at least a server 2008 in this case i'm a to the 2008 r2
and then i'm going to check and again there's there's several ways you can do this
one way in the gui you can come in here to active directory users and computers and
you can find the kerberos user down here and you can reset the password right here in the gui now
most of you obviously do not have the servers with desktop experience so you're going to be doing it
with powershell and there's a script out here that you can run and this is the
script that i'm testing out and this gives me three tests or three ways i can do it the first
one is informational mode so we're going to run it and make sure that we're set to
actually run the script it's making sure that i have all the pieces it's letting me know that
that i'm testing the domain making sure that that it's passing the checks on this and making sure
that i can actually do it later on so it's just running and making sure that the tests are set
the next one we can do is item number two and we can actually see how it's going to go
so bottom line this is one of those security things that is not new as you can see this has
been around since 2015 and hopefully you already do this on a regular basis at
least twice a year and again two times quickly after you've had a breach or suspected breach
and if you're a small to medium business especially after the exchange issue that
we've had recently make sure you understand and do this on a regular basis and add it to your
your tasks that you do inside your domain until next time this is susan bradley for cso online
you