Windows Active Directory - KRBTGT account gets locked out randomly

▲
0
▼

I am seeing recently that KRBTGT attempts to login however encounters event ID 4776 ( Bad Password) and ends up with Account Lockout.

Account Lockout:

Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon Account: krbtgt Source Workstation: Error Code: 0xC0000234

======

Bad Password Attempt

1)Need help in understanding when does KRBTGT attempt to login?

  1. Can this be an domain compromise attack such as Golden Ticket generation?

Does Golden Ticket generation [TGT] requires KRBTGT to authenticate ?

active-directory
asked on Stack Overflow Apr 21, 2021 by shadab basha

0 Answers

Nobody has answered this question yet.

User contributions licensed under CC BY-SA 3.0