Skip to content
MitoMito Docs

AD-KRBTGT-03: KRBTGT should have standard UAC settings (disabled account)
ID AD-KRBTGT-03
Severity Medium
Suite Active Directory (on-premises)
Product Active Directory
Feature Account security
Security area Authentication
Resource type User
User impact of fixing Low
Effort to fix Low
Framework controls nist-800-53-r5:CM-6 Configuration Settings
MITRE ATT&CK T1098
Reads from On-premises Active Directory

What this checks and how to fix it

Section titled “What this checks and how to fix it”

  • The KRBTGT account must have specific User Account Control (UAC) settings to maintain security. The standard UAC value for KRBTGT is 514, which represents:

  • NORMAL_ACCOUNT (0x0200 = 512): Standard user account

  • ACCOUNTDISABLE (0x0002 = 2): Account is disabled

  • Combined: 514 (0x0202)

Security Risks of Non-Standard UAC:

  • Enabled Account: KRBTGT should never be enabled
  • Delegation Flags: Could allow dangerous delegation configurations
  • Password Flags: DONT_EXPIRE_PASSWORD could prevent required rotations
  • Tampering Indicator: Non-standard UAC may suggest malicious modification

Control Type

Section titled “Control Type”

Preventive

Security Recommendation

Section titled “Security Recommendation”

  1. Maintain standard UAC (514):

    • Account must remain disabled
    • No additional flags should be set
    • Regular audits of UAC settings

  2. Investigate non-standard UAC immediately:

    • Determine who made changes
    • Assess if compromise has occurred
    • Reset UAC to standard value (514)

  3. Monitor for changes:

    • Implement alerts for KRBTGT account modifications
    • Include UAC changes in security monitoring

How the Test Works

Section titled “How the Test Works”

This test retrieves the KRBTGT account and:

  • Compares current UAC against standard value (514)
  • Decodes and displays all UAC flags
  • Reports any non-standard configurations
Section titled “Related Tests”
  • Test-MtAdKrbtgtPasswordLastSet - Checks KRBTGT password age
  • Test-MtAdKrbtgtLastLogon - Verifies no interactive logons

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.