Why is KRBTGT account in Windows Sever 2003 disabled?
The reason that the KRBTGT account is disabled in Windows 2000/2003 Server is that there is no reason or need for someone to be logging in with the KRBTGT domain account. Therefore, it cannot be enabled. Because it is a built-in account, you cannot enable or rename KRBTGT account. If you try to rename the account you will get the error:
One of the names could not be changed due to the following problem:
Cannot perform this operation on built-in accounts.
Please try again.
If you try to enable the account you will get the error:
Krbtgt could not be enabled due to the following problem:
Cannot perform this operation on built-in accounts.
Kerberos is the default authentication protocol in Windows 2000/2003. The KRBTGT account is used for Kerberos Ticket Granting Ticket (TGT). TGT is a ticket that must be presented to the Kerberos service when a session request is made. The TGT is enciphered with a key that is derived from the password of the KRBTGT account, which is known only to the Kerberos service. As administrators we don’t need to mess with this account.
