BPuhl’s Blog

A little bit of everything without actually being much of anything

Replication Version Number for your KrbTGT account password?

Posted by BPuhl on December 19, 2007

When  we flipped our REDMOND domain to Server 2008 domain functional mode, we experienced an issue with some of our application servers suddenly failing to authenticate.  We found that this was because Kerberos authentication was failing, as the domain KerbTGT password was changed during the domain mode switch.  In fact, if you look at our domain KrbTGT account, you see it as the following replication metadata:

C:\>repadmin /showobjmeta red-dc-11 “CN=krbtgt (Key Distribution Center Service Account),CN=Users,DC=redmond,DC=corp,DC=microsoft,DC=com”

Loc.USN                          Originating DC   Org.USN  Org.Time/Date        Ver Attribute
=======                          =============== ========= =============        === =========

65585069                      NA-WA-RED\RED-DC-10 151889264 2007-11-01 16:06:02    4 pwdLastSet

The “version 4” indicates that our KrbTGT password has actually been changed a few times in the past 8 years.

Naturally, we all thought this was “bad” (outages usually are), and the dev’s weren’t quite sure why the system didn’t handle this much more gracefully.  Although it’s unlikely that anyone would actually change their KrbTGT password, the system is designed to handle it.

We suspected a bug, so collected a bunch of data, and tried to repro this in a lab.  Unfortunately, we couldn’t ever repro the outages, so we went to the next step and worked with the developers to get some instrumentation to use when we did our next production domain.  This time we chose an Exchange resource domain to move to 2008 DFM, and everything went smoothly.

Even though there aren’t any bugs to fix, the PG has agreed to include documentation indicating that the krbtgt password gets changed when you flip to domain functional mode.

Just another one of those random tidbits of information which is good to have in your back pocket.


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: