STIGQter: STIG Summary: Microsoft Windows Server 2025 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026: STIGQter: STIG Summary: Microsoft Windows Server 2025 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:SV-278176r1192634_rule
V-278176
SRG-OS-000480-GPOS-00227
WN25-DC-000430
CAT II
10
Reset the password for the krbtgt account a least every 180 days. The password must be changed twice to effectively remove the password history. Changing once, waiting for replication to complete, and changing again reduces the risk of issues. Changing twice in rapid succession forces clients to reauthenticate (including application services) but is desired if a compromise is suspected.
PowerShell scripts are available to accomplish this such as at the following link:
https://gallery.technet.microsoft.com/Reset-the-krbtgt-account-581a9e51
Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc").
Select "Advanced Features" in the "View" menu if not previously selected.
Select the "Users" node.
Right-click on the krbtgt account and select "Reset password".
Enter a password that meets password complexity requirements.
Clear the "User must change password at next logon" check box.
The system will automatically change this to a system-generated complex password.
This requirement is applicable to domain controllers; it is not applicable for other systems.
Open "Windows PowerShell".
Enter "Get-ADUser krbtgt -Property PasswordLastSet".
If the "PasswordLastSet" date is more than 180 days old, this is a finding.
V-278176
False
WN25-DC-000430
This requirement is applicable to domain controllers; it is not applicable for other systems.
Open "Windows PowerShell".
Enter "Get-ADUser krbtgt -Property PasswordLastSet".
If the "PasswordLastSet" date is more than 180 days old, this is a finding.
M
5719