Ensure AltSecID attribute on the krbgt account is not populated

Topic

New Reply

https://twitter.com/JosephRyanRies/status/1526218059786199042

“If you manage an Active Directory, please do me a small favor. Make sure the AltSecID attribute on the krbtgt account is NOT populated PRIOR to deploying May updates to your DCs. There’s a bug, and trust me you don’t want to find it. (Not security related, just a crash)”

For more interesting reading….  https://adsecurity.org/?p=483

Susan Bradley Patch Lady

1 user thanked author for this post.

NetDef

Reply | Quote

Replies

I remember a certification class several years ago on AD where this topic came up.  The instructor was very adamant that we should never – ever – touch this account nor it’s properties.

Does not surprise me at all that internal MS testing on patches would assume this account to be unmodified.  Although I am dismayed at the apparent lack of error handling around this issue.  A LSASS level system crash is difficult to recover from!  Most admins I know would want to restore a cold metal backup on this event, but with AD in the mix that’s fraught with additional challenges.

~ Group "Weekend" ~

Reply | Quote

Download – PingCastle

More advice for Active Directory – try that tool to audit your AD

Susan Bradley Patch Lady

Reply | Quote