msktutil(1)

📦

version 1.2.2 · 4 versions

1.2.2 · debian trixie, epel 10, epel 9, fedora 43, fedora 44, ubuntu questing, ubuntu resolute, ubuntu stonking (latest)
1.1 · ubuntu jammy
1.2.1 · ubuntu noble
1.2 · debian bookworm

, in debian trixie, epel 10, epel 9, fedora 43, fedora 44, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 msktutil — the `msktutil(1)` page, bestie edition 💖

okay so. welcome to msktutil, a General Commands Manual entry, and honestly? she's a lot. but she's also so good once you get her. grab a snack, we're doing this together 🫶

✨ NAME ✨

msktutil — fetches and manages Kerberos keytabs in an Active Directory environment

✨ SYNOPSIS ✨

msktutil [mode] [parameter 1] [parameter 2] ...

literally just a mode and then as many params as you need. slay.

✨ DESCRIPTION ✨

okay so msktutil is a Unix/Linux keytab utility built for Microsoft Active Directory environments. like, that's her whole thing. she can:

create accounts in Active Directory
add service principals to those accounts
create local keytab files

...so that kerberized services can use Active Directory as their Kerberos infrastructure. 🎀

by default she's out here creating and managing machine accounts. if you want her to work on service accounts instead, that's what the --use-service-account option is for. also important: msktutil requires that the Kerberos client libraries are properly installed and configured to use Active Directory as a realm. no setup, no vibes. that's just how it is.

and here's the thing you need to know: whenever a principal gets added or a keytab gets updated, the secret password for the corresponding account is changed. by default that password is not stored, so it has to be reset every single time msktutil runs. 💀

the good news? all entries in the keytab get automatically updated whenever the password is reset. and the previous entries are left in the keytab, so sessions using older key versions won't break. not her being considerate 🥹 this behavior is similar to the way Windows hosts handle machine password changes. iykyk.

✨ CREDENTIALS ✨

there are two common methods of using this program. two paths. two vibes. pick yours. 🌈

method one: kinit with Administrator-like credentials that have permission to create computer objects in your Active Directory server. if you invoke the program with those credentials, you can create a new computer account or service account from scratch. main character energy, honestly. 👑

method two: pre-create the accounts with those credentials, and then invoke msktutil on a machine without any special permissions. when the computer account or service account already exists, msktutil will try to authenticate as that account using either the existing keytab, or — if that fails — a default password. when that default password isn't specified with the option --old-account-password, msktutil will use the default machine password. then it changes the password and updates the keytab appropriately. ✨ this is usually the more convenient option when joining many computers to the domain, fr fr.

so, to pre-create a computer account, you may use the Active Directory Users and Computers GUI, select "new computer" from the right click menu, and type the short DNS name. then right click on the newly created object and select "Reset account" to set the password to the default value. another alternative is to run msktutil in the pre-create mode. both methods accomplish the same thing. 💅

to pre-create a service account, you may use the Active Directory Users and Computers GUI, select "new user" from the right click menu, fill in all required data, set the password to a specific value and use setspn.exe to set the desired servicePrincipalName(s). you may also select "must change password at next logon".

✨ MODES ✨

create — Creates a keytab for the current host or a given service account. Equivalent to update --service host.
update — Forces a password change and updates all related service principal entries from the servicePrincipalName and userPrincipalName attributes. Updates dNSHostName for machine accounts and always updates msDS-supportedEncryptionTypes attributes with current values, and applies other changes as specified.
auto-update — Checks if the password is at least 30 days old (from pwdLastSet attribute), and that the account does not have password expiry disabled. If those conditions are met, acts just like msktutil update. Will also update if the keytab failed to authenticate but the default password did work (e.g. after resetting the account in AD). Otherwise, exits without doing anything (even if attribute modifying options are given). This option is intended for use from a daily crontab to ensure that the password is rotated regularly. 🕐
pre-create — Pre-create (or update) an account for the given host with default password. Does not use or update local keytab. Requires -h or --computer-name argument. Implies --user-creds-only. Generally requires administrator credentials.
flush — Flushes out principals for the current accountname from the keytab, and makes corresponding changes to the machine or service account.
cleanup — Deletes entries from the keytab that are no longer needed.
delete — Deletes the host or service account from Active Directory.

🚨 bestie the delete mode does exactly what it sounds like. read it twice.

✨ OPTIONS ✨

🌸 COMMON OPTIONS

-v, --version — Displays version information
--help — Displays a help message
--verbose — Enables verbose status messages. May be specified more then once to get LDAP debugging. (yes, more than once. stack 'em. 🔥)

🌸 CONNECTION/SETUP OPTIONS

-b, --base <base ou> — Specifies an LDAP base OU when creating a new account. Unless the given string ends with the domain's base DN, it is assume to be a relative path: For example, specifying -b OU=Unix for a computer named SERVER in an Active Directory domain example.com would create a computer account in the LDAP path: CN=SERVER,OU=Unix,DC=EXAMPLE,DC=COM. This option can also be specified by setting the MSKTUTIL_LDAP_BASE environment variable to the desired value.

If not specified, the default value is read from AD (and the default there, unless modified by an admin, is CN=Computers for machine accounts and CN=Users for service accounts).

--computer-name <name> — Specifies that the new account should use <name> for the computer account name and the SAM Account Name. Note that a $ will be automatically appended to the SAM Account Name. Defaults to the machine's hostname, excluding the realm, with dots replaced with dashes.

That is: if the realm is EXAMPLE.COM, and the hostname is FOO.EXAMPLE.COM, the default computer name is FOO. If the hostname is FOO.BAR.EXAMPLE.COM, the default computer name is FOO-BAR. 🦋

--account-name <name> — An alias for --computer-name that can be used when operating on service accounts. Note that a $ will not be automatically appended to the SAM Account Name when using service accounts.
--old-account-password <password> — Use supplied account password for authentication. This is useful if the keytab does not yet exist but the password of the computer account is known. This password will be changed by msktutil in order to create or update the keytab.
--password <new_password> — Specify the new account password instead of generating a random one. Consider the password policy settings when defining the string. 📝
--dont-change-password — Do not create a new password. Try to use existing keys when performing keytab updates or the old password when creating a new keytab. This is useful for adding new SPNs to a machine or service account. This option is only available in update or create mode. In create mode the old password needs to be specified with --old-account-password.
-h, --hostname <name> — Overrides the current hostname to be used to be <name>. If this is not specified, the local host name will be used. Note that the local name lookup service will be to qualify and resolve names into fully-qualified names, including a domain extension. This affects the default hostname for other arguments, and the default computer-name. The hostname is also used to set the dNSHostName attribute.
-k, --keytab <file> — Specifies to use <file> for the keytab. This option can also be specified by setting the MSKTUTIL_KEYTAB environment variable to the name of the desired keytab file. This keytab is both read from, in order to authenticate as the given account, and written to, after updating the account password. Default: /etc/krb5.keytab 🎀
--keytab-auth-as <name> — Specifies which principal name we should try to use, when we authenticate from a keytab. Normally, msktutil will try to use the account name or the host principal for the current host. If this option is specified, instead msktutil will try to use the given principal name first, and only fall back to the default behavior if we fail to authenticate with the given name. This option can be useful if you do not know the current password for the relevant account, do not have a keytab with the account principal, but you do have a keytab with a service principal associated with that account. 👑
--server <server> — Specifies to use <server> as the domain controller. This affects both Kerberos and LDAP operations. The server can also be specified by setting the MSKTUTIL_SERVER environment variable. Default: looked up in DNS from the realm name.
--server-behind-nat — When the server is behind a firewall that performs Network Address Translation, KRB-PRIV messages fail validation. This is because the IP address in the encrypted part of the message cannot be rewritten in the NAT process. This option ignores the resulting error for the password change process, allowing systems outside the NAT firewall to join the domain managed by servers inside the NAT firewall. 🧚
--realm <realm> — Specifies to use <realm> as Kerberos realm. Default: use the default_realm from [libdefaults] section of krb5.conf.
--site <site> — Find and use domain controller in specific AD site. This option is ignored if option --server is used.
-N, --no-reverse-lookups — Do not attempt to canonicalize the name of the domain controller via DNS reverse lookups. You may need to do this if your client cannot resolve the PTR records for a domain controller or your DNS servers store incorrect PTR records. Default: Use DNS reverse lookups to canonicalize DC names.
-n, --no-canonical-name — Do not attempt to canonicalize the hostname while creating names of Kerberos principals. Instead use supplied hostname. This may be needed for systems where forward and reverse DNS lookups do not return the same (a dynamic DNS system for example where lookup for myhost.mydomain returns IP X.Y.Z.W, but lookup for IP X.Y.Z.W returns a name different than myhost.mydomain). 😭

okay that's part 1 bestie, deep breath, more is coming 💜

--user-creds-only — bestie, don't even try to authenticate with a keytab here. Just use the user's credentials (the ones you got from, like, kinit). Why would you want this? Because some attributes are locked behind Administrator credentials (in a default AD setup those are description, userAccountControl, userPrincipalName) and this is how you get in. 👑
--auto-update-interval <days> — the number of <days> before msktutil's auto-update goes and changes the account password. Defaults to 30 days, so mark your calendar ig 🗓️
-m, --sasl-mechanisms <mechanisms list> — a space-separated list of candidate SASL mechanisms to use when it's time to do the LDAP bind. The first mechanism in the list that both the client (that's the host running msktutil, hiii) and the server (Active Directory) support is the one that gets used. If you're giving it more than one candidate mechanism, quote the whole list so the shell doesn't eat your whitespace, fr fr. Default: "GSS-SPNEGO GSSAPI".

🎀 OBJECT TYPE/ATTRIBUTE-SETTING OPTIONS 🎀

--use-service-account — create and maintain service accounts instead of machine accounts. Glow-up, but for accounts ✨
--delegation — lets the account be trusted for delegation. You can also turn this on with the MSKTUTIL_DELEGATION environment variable. It modifies the userAccountControl attribute. Generally requires administrator credentials, so like… bring your admin hat 🧢
--description <text> — sets the account's description attribute to whatever <text> you give it (or removes it if <text> is ''). Generally requires administrator credentials.
--disable-delegation — stops the account from being trusted for delegation. Also modifies the userAccountControl attribute. Generally requires administrator credentials.
--disable-no-pac — unsets the flag that stops the KDC from including a PAC in the machine's service tickets. Modifies the userAccountControl attribute. Generally requires administrator credentials.
--dont-expire-password — sets the DONT_EXPIRE_PASSSWORD bit in the userAccountControl attribute, which disables password expiry for this account. If you're not running a cron job to rotate the keytab periodically, you're gonna want this flag. Generally requires administrator credentials. (Yes, the manpage really spells it DONT_EXPIRE_PASSSWORD with three S's — we don't make the rules, we just report them 💀)
--do-expire-password — unsets the DONT_EXPIRE_PASSWORD flag in the userAccountControl attribute. Generally requires administrator credentials. Back to expiring, bestie 🫶
--dont-update-dnshostname — don't update the dnsHostName attribute. Some AD installations straight up won't let you modify this attribute (unless you're rolling with administrator credentials), so using this option avoids that constraint violation warning. Peace and quiet 😌
--enable — unsets the UF_ACCOUNT_DISABLE flag in the userAccountControl attribute. When a computer leaves the domain this flag is normally set, so this is the "welcome back" button. Generally requires administrator credentials.
--enctypes <integer> — sets the supported encryption types in the msDs-supportedEncryptionTypes field. You may OR together the following values:

0x1=des-cbc-crc
0x2=des-cbc-md5
0x4=rc4-hmac-md5
0x8=aes128-cts-hmac-sha1
0x10=aes256-cts-hmac-sha1

This value is what determines which encryption types AD will offer to use, and which encryption types get put in the keytab. If the value is set to 0x3 (that is: only the two DES types), it also attempts to set the DES-only flag in userAccountControl.

Note: Windows 2008R2 refuses to use DES by default, so you cannot use DES-only keys unless you have enabled DES encryption for your domain first. Recent versions of MIT Kerberos clients similarly refuse to use DES by default. So like… DES is not the vibe anymore 🚫

Default: sets the value to 0x1C: that is, use anything but DES. 🎉

--allow-weak-crypto — enables the usage of DES keys for authentication. This is equivalent to MIT's krb5.conf parameter allow_weak_crypto. It's giving "yes I know, I'm choosing this" energy.
--no-pac — says that service tickets for this account should not contain a PAC. This modifies the userAccountControl attribute. See Microsoft Knowledge Base article #832575 for the details. You can also specify this option by setting the MSKTUTIL_NO_PAC environment variable. Generally requires administrator credentials.
-s, --service <principal> — specifies a service principal to add to the account (and therefore to the keytab too, if that's appropriate). The service is of the form <service>/<hostname>. If you omit the hostname, it assumes the current hostname. You can specify this multiple times, go off 💅 When creating machine accounts, entries for the host service are created by default — unless --service is given. And heads up: unqualified service names (ones without a / component) get qualified with the full and the short hostnames, e.g. host/hostname.example.com and host/hostname.
--remove-service <principal> — specifies a service principal to remove from the account (and the keytab if appropriate). Breakup era 💔
--upn <principal> — sets the userPrincipalName attribute of the computer account or service account to be <principal>. The userPrincipalName can be used in addition to the sAMAccountName (e.g. computername$ for computer accounts) for kinit. <principal> can be given in short form (e.g. host/hostname.example.com) or in long form (e.g. host/hostname.example.com@EXAMPLE.COM). In short form the default realm gets appended automatically. 🪄 This operation requires administrator privileges.
--set-samba-secret — use Samba's net changesecretpw command to locally set the machine account password in Samba's secrets.tdb. Your $PATH needs to include Samba's net command, and Samba needs to be configured appropriately. Teamwork makes the dream work 🤝
--use-samba-cmd <command> — use the supplied command instead of Samba's net changesecretpw command. command will be supplied the machine account password on standard input and shall return 0 exit code on success. Very "I brought my own tool" of you 🛠️
--check-replication — wait until the password change is reflected in LDAP. By default, msktutil exits once a password update is successful and the new keytab is written. But due to replication delays, LDAP queries might still return an older key version number. If --check-replication is given, msktutil waits until the key version number is updated on the queried LDAP server as well. Note that this is just a sanity check: the new password is supposed to be accepted on all domain controllers once the update succeeds, even if LDAP isn't in sync yet. Turning on this option might substantially increase the runtime of msktutil in some environments because of replication delays (eg. 15 to 30 minutes for common AD configurations 😭). The default is not to check LDAP replication.

🧹 CLEANUP OPTIONS 🧹

--remove-old <number> — removes entries from the keytab that are older than <number> days. The newest keytab entries get kept so you can't accidentally nuke everything — i.e. it is not possible to produce an empty keytab with the --remove-old option. Safety first, bestie 🫶
--remove-enctype <enctype> — removes entries from the keytab with the given encryption type.

Warning: it is possible to produce empty keytabs with the --remove-empty option by successively removing all encryption types. Yikes, be careful 💀

Supported enctype strings are: des-cbc-crc, des-cbc-md5, arcfour, aes128 and aes256.

📝 NOTES 📝

⏰ PASSWORD EXPIRY ⏰

Okay bestie, real talk, this one matters. Windows machines will, by default, just casually change their account password every 30 days, and because of that lots of domains have a 90-day password expiry window — and once that window closes, your keytab is done. It stops working. It's giving expired milk. 💀

There are two ways to deal with this:

(Preferred) — Make sure you're running a daily cron job that runs msktutil auto-update. That bad boy changes the password automatically 30 days after it was last changed and updates the keytab. Obsessed. ✨
(Not preferred) — turn off password expiry for the account using the --dont-expire-password option (or by setting the DONT_EXPIRE_PASSWORD flag in userAccountControl in AD some other way).

🔐 PASSWORD POLICY ISSUES 🔐

Heads up: this whole section only applies to msktutil --use-service-account.

Machine account passwords can be changed whenever, no drama. But service accounts are user accounts, and your Active Directory domain might have special password policies for those. Like, "minimum password age" is typically set to 1 day, which means you literally have to sit there and wait for that time to pass before you can run msktutil update --use-service-account. Patience era. 🧘‍♀️

🦋 OTHER NOTES 🦋

Unlike other Kerberos implementations, Active Directory has only a single key for all of the principals associated with an account. So if you create a HTTP/hostname service principal, it shares the same key as the host/hostname principal. If you want to isolate different service principals (security-wise, bestie, think about it 👀), you might want to create a dedicated service account for them with --use-service-account and a separate keytab file with --keytab.

Also note, and I need you to hear me on this one: kinit -k 'host/computername' will not work, by default — even when that's a totally valid service principal sitting right there in your keytab. Active Directory does not let you authenticate as a service principal, so do not use that as your test of whether the service principal is working. If you actually want to authenticate as the computer account user, do kinit -k 'computername$' instead. That's the one. 💅

And if you really need to be able to authenticate as 'host/computername', you can use the --upn argument to set the userPrincipalName attribute (which generally requires administrator credentials, not computer account credentials, fyi). Both 'computername$' and the value of userPrincipalName are treated as valid account names to kinit as.

msktutil will use kerberized LDAP operations to talk to domain controllers. To obtain a LDAP service ticket, the DNS service gets used to construct the domain controller's LDAP principal name. If DNS is misconfigured, that construction may fail. 😭 To work around it, you can specify the fully qualified DNS name of your domain controller with the --server option and additionally use the --no-reverse-lookups option. Problem solved, slay.

Samba (www.samba.org) provides the net command, which can also be used to manage Kerberos keytabs. Using msktutil and commands like "net ads join" or "net ads keytab" together can lead to trouble. 🙈 With the --set-samba-secret option, msktutil can be used as a replacement for net.

Active Directory includes authorization data (like info about group memberships) in Kerberos tickets. This information is called PAC and it may lead to very large ticket sizes. Especially HTTP services are known to produce failures if that size exceeds the HTTP header size. If your service doesn't make use of that PAC information (which is true for most Unix/Linux-services), you may just disable it with the --no-pac option. Simple as that. ✨

🌈 EXAMPLES 🌈

For unprivileged users, the most common invocations are:

msktutil create

This will create a computer account in Active Directory with a new password and write out a new keytab. Brand new, fresh start, main character energy. 👑

msktutil update --service host --service HTTP

This will update a computer account in Active Directory with a new password, write out a new keytab, and ensure that it has both "host" and "HTTP" service principals are on it for the hostname.

msktutil update  --dont-change-password --service host --service HTTP

This will do the same as the last example but without changing the password. (Yes, there are two spaces after update in there — that's how it is, we don't edit the lore. 💖)

msktutil auto-update

This is useful in a daily cron job to check and rotate the password automatically when it's 30 days old.

For users with admin privileges in AD, some common uses:

msktutil create --service host --service HTTP

This will create a computer account in Active Directory with a new password, write out a new keytab, and ensure that it has both "host" and "HTTP" service principals are on it for the hostname.

msktutil pre-create --host computer1.example.com

This will pre-create an account for computer1 with the default password using your credentials. This can be done on a central host, e.g. to script the addition of many hosts. You can then use msktutil create on the hosts themselves (without special credentials) to join them to the domain. Efficient queen. 🎀

msktutil create --host afs --service afs --enctypes 0x03

This will create an afs/cell.name@REALM principal, and associate that principal with a computer account called 'afs'. The principal will be marked as DES-only, which is required for AFS.

msktutil create --use-service-account --service HTTP/hostname.example.com --keytab /etc/apache/krb5.keytab --account-name srv-http --no-pac

This will create an HTTP/hostname.example.com@REALM principal, and associate that principal with a service account called 'srv-http'. Corresponding Kerberos keys will be written to the keytab file /etc/apache/krb5.keytab. The size of Kerberos tickets for that service will stay small because no PAC information will be included. Tiny tickets, huge vibes. 🦋

msktutil create --keytab /etc/krb5/user/10123/client.keytab --use-service-account --account-name johndoe --dont-change-password --old-account-password <John Doe's Password>

This will create a keytab for johndoe without changing John Doe's password. Respecting boundaries, we love to see it. 🫶

msktutil create --service host/hostname --service host/hostname.example.com --set-samba-secret --enctypes 0x4

This will create a computer account in Active Directory that is compatible with Samba. The command creates a new password, write out a new keytab, and ensure that it includes both "host/hostname" and "host/hostname.example.com" as service principals (which is equivalent to what setspn.exe -R would do on Windows). The new computer password will be stored in Samba's secrets.tdb database to provide interoperability with Samba. As Samba (version 3) only supports arcfour encrypted Kerberos tickets, the --enctypes option must be used to select only that encryption type.

msktutil cleanup --remove-old 10

Deletes all entries older than 10 days, keeping at least the last entry. Spring cleaning, but for LDAP. 🧹✨

🌱 ENVIRONMENT 🌱

MSKTUTIL_LDAP_BASE — Specifies a relative LDAP base when creating a new account (see --base),
MSKTUTIL_KEYTAB — Specifies the keytab. Default: /etc/krb5.keytab (see --keytab),
MSKTUTIL_SERVER — Specifies the domain controller (see --server).
MSKTUTIL_DELEGATION — Enables the account to be trusted for delegation (see --delegation).
MSKTUTIL_NO_PAC — Specifies that service tickets for this account should not contain a PAC (see --no-pac).
MSKTUTIL_SAMBA_CMD — Specifies the command to be used to locally set the machine account password in Samba's secrets.tdb.

👑 AUTHORS 👑

Shoutout to the legends, the icons, the ones who actually built this thing. 💜

And that's the whole page, bestie!! 🎉 You just read the msktutil(1) manual, version 1.2.2, and honestly? You ate. Go make some keytabs, run your cron job, and hydrate. 💖✨🌸

📦 where this page comes from

debian trixie: msktutil 1.2.2-1 · GPL-2.0-or-later
epel 10: msktutil 1.2.2-2.el10_1 · GPL-2.0-or-later
epel 9: msktutil 1.2.2-1.el9 · GPL-2.0-or-later
fedora 43: msktutil 1.2.2-2.fc43 · GPL-2.0-or-later
fedora 44: msktutil 1.2.2-3.fc44 · GPL-2.0-or-later
ubuntu questing: msktutil 1.2.2-1
ubuntu resolute: msktutil 1.2.2-1build1 · GPL-2.0-or-later
ubuntu stonking: msktutil 1.2.2-1build1 · GPL-2.0-or-later
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-10-13: a language model's rewrite of the original, under its terms