Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are having an issue with our blackberry server (EWSTest fails at autodiscover lookup) and I am running a packet capture with Wireshark in an attempt to diagnose the issue. There is a conversation that is encrypted with Kerberos (RC4-HMAC) that I would like to read.

After some research, I found that a keytab is necessary. I read up on using ktpass to generate the keytab, but I am only able to do so for a user account. It appears the server (rather than a user) is the ticket-requesting client since the AP-REQ has no username. I am not sure how to create a keytab for a server since I don't know what to enter for the computer's password. (and am afraid to inadvertently reset the computer's password)

Any recommendations on how to generate a keytab for a computer object without breaking anything? (and no, we have no lab environment)

share|improve this question
From MS site..The local copy of the machine password is stored under: HKLM\SECURITY\Policy\Secrets\$machine.ACC We store the current password and the previous password under CurrVal & OldVal Keys respectively – dc5553 Apr 27 '12 at 21:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.