Should Passwords For K/M and krbtgt Accounts Be Rotated

Products

• VMware vCenter Server

Issue/Introduction

To satisfy security needs password rotation is required for accounts.

Environment

vSphere 8.x

Resolution

Regarding the K/M and krbtgt accounts in thevsphere.local domain, Broadcom does not recommend rotating these passwords or disabling these accounts.  These are internal system service principals created automatically during the vCenter installation with randomly generated 20-character passwords. They are essential for the operation of the vCenter Single Sign-On (SSO) service, particularly for Kerberos authentication and key management. Manually changing these credentials can lead to authentication failures and service instability.