krbtgt

Age of the krbtgt password, by WinRM

Returns the age, in days, of the password of each krbtgt account of the domain of a domain controller: the key that signs every Kerberos ticket of the domain. A ticket forged with a stolen copy of that key stays valid as long as the key is not changed. Two watches are proposed, both checked: a password too old, and the account krbtgt not found.

Versions

A domain controller running Windows Server 2012 or later, with Windows PowerShell 3.0 or later, as the prerequisites name them. Generic: no folder of version. That every release answers alike is assumed, not yet checked on a real domain controller.

How it works

The collector runs one PowerShell script, by WinRM, that searches the directory over LDAP, on the domain controller itself, for the users whose sAMAccountName starts with krbtgt:

$ErrorActionPreference = 'Stop'; [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding; $computer = Get-CimInstance Win32_ComputerSystem; $server = $computer.DNSHostName + '.' + $computer.Domain; $rootDSE = [ADSI]('LDAP://' + $server + '/RootDSE'); $domain = [ADSI]('LDAP://' + $server + '/' + $rootDSE.Properties['defaultNamingContext'][0]); $searcher = New-Object DirectoryServices.DirectorySearcher($domain, '(&(objectCategory=person)(objectClass=user)(sAMAccountName=krbtgt*))', @('sAMAccountName', 'pwdLastSet')); $now = [DateTime]::UtcNow; $accounts = @($searcher.FindAll() | ForEach-Object { @{name = [string]$_.Properties['samaccountname'][0]; days = [long]($now - [DateTime]::FromFileTimeUtc([long]$_.Properties['pwdlastset'][0])).TotalDays} }); ConvertTo-Json -Compress -Depth 4 -InputObject @{accounts = $accounts}

• WinRM hands the script to PowerShell itself: the script is the one of active-directory/ssh/krbtgt, without the powershell -Command "…" that cmd.exe needs there.
• The search starts at the domain, defaultNamingContext of the RootDSE of the domain controller, and reads two attributes of the schema of Active Directory: sAMAccountName and pwdLastSet, the time of the last change of the password, in hundreds of nanoseconds since 1 January 1601 UTC. The age is counted in whole days, on the domain controller.
• The accounts found are krbtgt, the key of the domain, and krbtgt_<number>, the key of each read-only domain controller; any other account whose name starts with krbtgt is returned too.
• No krbtgt account found stops the collector as misconfigured, as does an answer that is not the expected JSON.

Nothing is written to the Windows or to the directory: the script only reads. Changing the krbtgt password is the work of an administrator, twice, a replication apart.

Prerequisites

• A domain controller running Windows Server 2012 or later, with Windows PowerShell 3.0 or later.
• The WinRM service listening in HTTPS, on TCP 5986 or the port set in protocol:winrm:port, open in the Windows firewall to the poller, with a certificate the poller judges by the TLS profile of the probe or pins in protocol:winrm:fingerprint: the steps are those of the windows/winrm/services collector of banshee/windows-collection. NTLM authentication, which the WinRM service accepts as installed.
• An account of the domain for monitoring, without administrator rights, set in protocol:winrm:user (DOMAIN\account or account@domain) with its password in protocol:winrm:password, member of the group "Remote Management Users" of the domain (on a domain controller, the built-in group of the Builtin container). No other group is given here (see Limits).

Outputs

Watches

Limits

• Not yet checked on a real domain controller: the execution; that an account of the domain without administrator rights reads pwdLastSet of the krbtgt accounts. The accounts are protected by AdminSDHolder, whose rights a domain may have narrowed. If it may not, the collector stops as misconfigured, or returns no account; the right to read the attribute is then given to the account on those objects, never by making it an administrator.