During the eradication phase of an incident involving a compromised Active Directory environment, the team identifies that the attacker created a Golden Ticket using a stolen KRBTGT hash. Which eradication action is specifically required to invalidate all existing Golden Tickets?

B is correct because Golden Tickets are signed using the KRBTGT password hash; resetting KRBTGT twice invalidates all previously issued tickets (the second reset removes the lingering old hash from the password history used for backward compatibility). A is wrong because resetting user passwords does not affect Kerberos tickets already issued with the KRBTGT hash. C is wrong because SSL certificates are unrelated to Kerberos ticket validation. D is wrong because workstation rebuilds do not invalidate tickets already held by the attacker.