KDC Event Error

[Barry Stewart]

I'm getting an "Event ID: 8" error on my Domain
Controllers. The associated error description is:

"The account Administrator did not have a suitable key for
generating a Kerberos ticket. If the encryption type is
supported, changing the password will generate a proper
key."

Also, when I check in "Active Directory Users and
Computers", the "krbtgt" account under "Users" is
disabled. Is there anything I need to worry about here or
should I leave things alone?

Barry

 

[Aimme Lirette MSFT]

The krbtgt account is disabled by default and should be left that way.

The event errors that you are seeing should be looked into.

How many domain controllers are in the environment?
You may want to run a DCDIAG to see if any errors show up there.
Also, make sure the Kerberos Key Distribution Service is started on the
domain controller. If it isn't, start the service and reboot the server.

Check the time and date (and year) on the DC make sure that is all correct.

Aimme