A library’s compromise-recovery plan for Active Directory never mentions the krbtgt account password. What recovery-hygiene point should the tester emphasize?
Select an answer to reveal the explanation.
Short Explanation
Think of krbtgt as the master stamp that makes domain tickets look official. After a real domain compromise scare, recovery talk has to include how that stamp gets replaced — not just patching a few desktops. Skipping krbtgt in the recovery plan leaves a hole in the hygiene checklist.
Full Explanation
After suspected domain compromise, krbtgt account password reset planning belongs in Active Directory recovery discussions. The krbtgt account is central to Kerberos ticket granting; recovery hygiene for a library or any civic directory should include sequenced krbtgt resets so forged tickets from a breach lose validity under a deliberate recovery plan.
krbtgt is not a legacy print spooler account and must not be deleted casually. Local SAM hashes alone do not constitute complete domain recovery thinking. krbtgt passwords are not “never rotated because DHCP issues tickets”—that distractor confuses unrelated services.
Exam caveat: recovery playbooks should cover krbtgt reset timing/sequencing and related trust considerations without turning the explanation into an unauthorized how-to for forging tickets. CPTS emphasizes defender-aware AD recovery themes.
Operational check: ensure the municipal AD compromise-recovery plan names krbtgt handling, assigns owners, and pairs resets with credential rotation and trust review after a suspected breach. Pair krbtgt recovery steps with communication plans for library staff outages so restoration of Kerberos trust does not surprise public-service operators.