Active Directory: krbtgt the scary account

# Example using Mimikatz (for educational purposes)
# Extracting the krbtgt hash on a compromised DC
lsadump::lsa /patch

# Forging a Golden Ticket valid for 10 years for "Administrator"
kerberos::golden /user:Administrator /domain:mydomain.local 
  /sid:S-1-5-21-... /krbtgt:<hash_ntlm> /endin:87600

# Required Windows module
pip install pywinrm
ansible-galaxy collection install ansible.windows

# Enable WinRM (if not already done via GPO)
Enable-PSRemoting -Force
winrm set winrm/config/service/auth '@{Basic="true"}'
winrm set winrm/config/service '@{AllowUnencrypted="false"}'

# inventory/production.yml
all:
  children:
    domain_controllers:
      hosts:
        dc01.mydomain.local:
          ansible_host: 192.168.1.10
        dc02.mydomain.local:
          ansible_host: 192.168.1.11
      vars:
        ansible_user: "MYDOMAIN\\ansible_svc"
        ansible_password: "{{ vault_ansible_password }}"
        ansible_connection: winrm
        ansible_winrm_transport: kerberos
        ansible_winrm_server_cert_validation: validate
        ansible_port: 5986

# Encrypting the vault
ansible-vault create group_vars/all/vault.yml
# Content:
# vault_ansible_password: "YourAnsibleServicePassword"

# roles/krbtgt_rotation/defaults/main.yml

# Time between rotations (in seconds)
# 36000 = 10 hours (Microsoft recommendation)
# For testing, you can reduce this to 60 seconds
krbtgt_rotation_delay: 36000

# Mode: 'simulate' (dry-run) or 'reset' (actual rotation)
krbtgt_operation_mode: "simulate"

# Temporary path on the DC for the script
krbtgt_script_dest: "C:\\Windows\\Temp\\New-KrbtgtKeys.ps1"

# Target domain (will be detected automatically if empty)
krbtgt_domain: ""

# roles/krbtgt_rotation/tasks/main.yml
---

# ─── Pre-checks ───────────────────────────────────────────────────────

- name: Check that the ActiveDirectory module is available
  ansible.windows.win_powershell:
    script: |
      if (-not (Get-Module -ListAvailable -Name ActiveDirectory)) {
          throw "ActiveDirectory module not available. Install RSAT."
      }
      Write-Output "OK"      
  register: ad_module_check
  changed_when: false

- name: Identify the domain PDC Emulator
  ansible.windows.win_powershell:
    script: |
      $pdc = (Get-ADDomain).PDCEmulator
      Write-Output $pdc      
  register: pdc_emulator
  run_once: true
  changed_when: false

- name: Display the identified PDC Emulator
  ansible.builtin.debug:
    msg: "PDC Emulator: {{ pdc_emulator.output[0] }}"
  run_once: true

# ─── Script Deployment ───────────────────────────────────────────────────

- name: Copy the New-KrbtgtKeys.ps1 script to the DC
  ansible.windows.win_copy:
    src: New-KrbtgtKeys.ps1
    dest: "{{ krbtgt_script_dest }}"
  when: inventory_hostname == pdc_emulator.output[0].split('.')[0]

# ─── Checking the current status ──────────────────────────────────────────

- name: Check the date of the last krbtgt password change
  ansible.windows.win_powershell:
    script: |
      $krbtgt = Get-ADUser krbtgt -Properties PasswordLastSet, msDS-KeyVersionNumber
      $result = @{
          PasswordLastSet   = $krbtgt.PasswordLastSet.ToString("yyyy-MM-dd HH:mm:ss")
          KeyVersionNumber  = $krbtgt.'msDS-KeyVersionNumber'
          DaysSinceChange   = ((Get-Date) - $krbtgt.PasswordLastSet).Days
      }
      Write-Output ($result | ConvertTo-Json)      
  register: krbtgt_current_state
  run_once: true
  changed_when: false
  delegate_to: "{{ pdc_emulator.output[0] }}"

- name: Display the current state of the krbtgt account
  ansible.builtin.debug:
    msg: "{{ krbtgt_current_state.output[0] | from_json }}"
  run_once: true

# ─── First rotation ───────────────────────────────────────────────────────

- name: "First krbtgt rotation (mode: {{ krbtgt_operation_mode }})"
  ansible.windows.win_powershell:
    script: |
      $params = @{
          OperationMode = "{{ krbtgt_operation_mode }}"
          DomainFQDN    = (Get-ADDomain).DNSRoot
      }
      & "{{ krbtgt_script_dest }}" @params      
  register: rotation_first
  run_once: true
  delegate_to: "{{ pdc_emulator.output[0] }}"
  when: krbtgt_operation_mode == "reset"

- name: Log of the first rotation
  ansible.builtin.debug:
    msg: "{{ rotation_first.output }}"
  run_once: true
  when: krbtgt_operation_mode == "reset"

# ─── Checking replication before waiting ────────────────────────

- name: Force AD replication to all DCs
  ansible.windows.win_powershell:
    script: |
      repadmin /syncall /AdeP
      Start-Sleep -Seconds 30
      repadmin /showrepl      
  register: repl_check_1
  run_once: true
  delegate_to: "{{ pdc_emulator.output[0] }}"
  when: krbtgt_operation_mode == "reset"

- name: Check that replication has no errors
  ansible.windows.win_powershell:
    script: |
      $errors = repadmin /showrepl 2>&1 | Select-String "fail|error" -CaseSensitive:$false
      if ($errors) {
          Write-Warning "Replication errors detected:"
          $errors | ForEach-Object { Write-Warning $_.Line }
          # Log but do not block - the admin must investigate
      } else {
          Write-Output "Replication OK"
      }      
  register: repl_errors
  run_once: true
  delegate_to: "{{ pdc_emulator.output[0] }}"
  changed_when: false

# ─── Inter-rotation wait ──────────────────────────────────────────────────

- name: "Wait {{ krbtgt_rotation_delay }} seconds between rotations"
  ansible.builtin.pause:
    seconds: "{{ krbtgt_rotation_delay }}"
  run_once: true
  when: krbtgt_operation_mode == "reset"

# ─── Second rotation ────────────────────────────────────────────────────────

- name: "Second krbtgt rotation (permanently invalidating old tickets)"
  ansible.windows.win_powershell:
    script: |
      $params = @{
          OperationMode = "{{ krbtgt_operation_mode }}"
          DomainFQDN    = (Get-ADDomain).DNSRoot
      }
      & "{{ krbtgt_script_dest }}" @params      
  register: rotation_second
  run_once: true
  delegate_to: "{{ pdc_emulator.output[0] }}"
  when: krbtgt_operation_mode == "reset"

- name: Log of the second rotation
  ansible.builtin.debug:
    msg: "{{ rotation_second.output }}"
  run_once: true
  when: krbtgt_operation_mode == "reset"

# ─── Post-rotation verification ──────────────────────────────────────────────

- name: Verify the new Kerberos version number (msDS-KeyVersionNumber)
  ansible.windows.win_powershell:
    script: |
      $krbtgt = Get-ADUser krbtgt -Properties PasswordLastSet, msDS-KeyVersionNumber
      $result = @{
          PasswordLastSet  = $krbtgt.PasswordLastSet.ToString("yyyy-MM-dd HH:mm:ss")
          KeyVersionNumber = $krbtgt.'msDS-KeyVersionNumber'
      }
      Write-Output ($result | ConvertTo-Json)      
  register: krbtgt_new_state
  run_once: true
  changed_when: false
  delegate_to: "{{ pdc_emulator.output[0] }}"

- name: Post-rotation summary
  ansible.builtin.debug:
    msg:
      - "=== krbtgt rotation complete ==="
      - "New state: {{ krbtgt_new_state.output[0] | from_json }}"
      - "Remember to document this rotation in your CMDB."
  run_once: true

# ─── Cleanup ───────────────────────────────────────────────────────────────

- name: Remove the script from the DC after use
  ansible.windows.win_file:
    path: "{{ krbtgt_script_dest }}"
    state: absent
  when: inventory_hostname == pdc_emulator.output[0].split('.')[0]

# site.yml
---
- name: Rotate Active Directory krbtgt password
  hosts: domain_controllers
  gather_facts: false

  vars_files:
    - group_vars/all/vault.yml

  pre_tasks:
    - name: Display execution mode
      ansible.builtin.debug:
        msg: >
          Mode: {{ krbtgt_operation_mode | upper }}
          {% if krbtgt_operation_mode == 'simulate' %}
          (DRY-RUN - no changes will be made)
          {% else %}
          ⚠️  ACTUAL ROTATION - passwords will be changed
          {% endif %}
      run_once: true

  roles:
    - role: krbtgt_rotation

# Verification without any changes
ansible-playbook site.yml \
  --ask-vault-pass \
  -e "krbtgt_operation_mode=simulate"

# Rotation with a full 10-hour delay between the two passes
ansible-playbook site.yml \
  --ask-vault-pass \
  -e "krbtgt_operation_mode=reset" \
  -e "krbtgt_rotation_delay=36000"

# 60-second delay - ONLY in a test environment
ansible-playbook site.yml \
  --ask-vault-pass \
  -e "krbtgt_operation_mode=reset" \
  -e "krbtgt_rotation_delay=60"

# On each DC, verify that the version number is identical
Get-ADReplicationUpToDatenessVectorTable -Target "dc01.mydomain.local"

# Check the krbtgt kvno on all DCs
repadmin /showobjmeta * "CN=krbtgt,CN=Users,DC=mydomain,DC=local" | 
  Select-String "pwdLastSet|msDS-KeyVersionNumber"

- name: Rotation completion notification
  community.general.slack:
    token: "{{ vault_slack_token }}"
    channel: "#soc-alerts"
    msg: |
      ✅ *Krbtgt rotation completed*
      Domain: {{ ansible_domain }}
      Date: {{ ansible_date_time.iso8601 }}
      KeyVersionNumber: {{ krbtgt_new_state.output[0] | from_json | json_query('KeyVersionNumber') }}      
  run_once: true
  delegate_to: localhost

# inventory/production.yml
all:
  children:
    domain_infra:
      hosts:
        dc-infra-01.infradomain.local:
      vars:
        ansible_user: "INFRA\\ansible_svc"
        # ...

    domain_users:
      hosts:
        dc-users-01.userdomaine.local:
      vars:
        ansible_user: "USERS\\ansible_svc"
        # ...