0

We're trying to reset our krbtgt password/keys using the PowerShell script provided by Microsoft, obtained from here:

https://gallery.technet.microsoft.com/Reset-the-krbtgt-account-581a9e51?ranMID=24542&ranEAID=TnL5HPStwNw&ranSiteID=TnL5HPStwNw-fBZQOeWqTO1IENsFZImkRg&epi=TnL5HPStwNw-fBZQOeWqTO1IENsFZImkRg&irgwc=1&OCID=AID681541_aff_7593_1243925&tduid=(ir__b1osrdblekkfrnt10ckzh9lp2u2xmqfdv31my0xm00)(7593)(1243925)(TnL5HPStwNw-fBZQOeWqTO1IENsFZImkRg)()&irclickid=_b1osrdblekkfrnt10ckzh9lp2u2xmqfdv31my0xm00

However, we're getting the following error message when running it:

"Krbtgt reset failed. Check to ensure you have sufficient rights to reset the krbtgt account. Replication will be skipped"

We ran the script as an administrator and logged in as a user with admin rights to the server. Can anyone please give us tips on where the potential problem could be?

2
  • 1
    You say "administrator" and "admin", but you don't say "Domain Administrator" or "Domain Admin". The instructions are very clear about the authority required, and "admin rights to the server" are not the same as "admin rights to the domain". Regardless, its clear you are not running it with "sufficient rights" so you need to focus in that area.
    – Larryc
    May 14, 2019 at 8:24
  • I confirmed the account used to run the script is in the domain admins security group. Still getting the error message. Perhaps a GPO is causing this?
    – 72909903
    May 16, 2019 at 1:29

2 Answers 2

0

Important- Verify replication between all DC's involved.

Equally important- verify time synchronization between them as well.

I mentioned your issue to a couple friends and they suggest trying this Script.

3
  • Thanks LarryC. Unfortunately I can't reach that link from where I work but will try to check it out later. Our environment has only one DC (for now). We're starting to suspect that something on the server is blocking the input of the complex password generated by the script, for the krbtgt account. I checked the GPOs for PW complexity and no issues there. In the script, line 151, is the function 'New-CtmADKrbtgtAccountPassword' which resets the PW for the krbtgt account. Note the error message on line 159, 'Krbtgt key reset failed due to insufficient permissions.'
    – 72909903
    May 20, 2019 at 18:27
  • (cont'd from previous comment) That's not the error message we're receiving. The error message we're getting is from line 453, 'Krbtgt reset failed. Check to ensure you have sufficient rights to reset the krbtgt account. Replication will be skipped' That error message appears to be a more broad, general error message. So don't believe it's a permissions issue, it must be something on the server that's denying the resetting of the krbtgt account PW reset. And the account I'm running this script under is the same account we use to do PW resets...
    – 72909903
    May 20, 2019 at 18:35
  • (cont'd from previous comment) Perhaps this cmdlet on line 155 is what the server doesn't like: Try {Set-ADAccountPassword -Identity (Get-ADUser krbtgt -Server $Server).DistinguishedName -Server $Server -Reset -NewPassword (ConvertTo-SecureString ((New-CtmADComplexPassword 32).ToString()) -AsPlainText -Force)}
    – 72909903
    May 20, 2019 at 18:40
0

Discovered that the issue was caused by a 3rd party password filter that was active on the DC called "enpasflt".

Simply disable the "enpasflt" password filter by going to this Registry key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\Notification Packages

Remove any reference to "enpasflt" there, then reboot the server. The script should then execute successfully.

Reference for enpasflt:

https://www.stigviewer.com/stig/windows_server_2008_r2_member_server/2012-07-02/finding/V-1131

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .