Windows 2000 Kerberos Password Change Process

In Microsoft Windows 2000, domain user password changes over Kerberos rely on the Kerberos Change Password protocol operating on UDP or TCP port 464. When a user requests a password change, the client workstation obtains a specialized Ticket Granting Service (TGS) ticket for the password change service, encrypts the new password data using the negotiated session key, and transmits it directly to the Key Distribution Center (KDC) on a Domain Controller. The KDC verifies the request, enforces Active Directory domain password policies, updates the user's account credentials in the directory database, and returns an encrypted status response to the client.

Step 1: Initial Authentication and Service Ticket Request

Before initiating a password change, the client machine must already possess a valid Ticket Granting Ticket (TGT) for the user. When the user initiates a password change (such as via the Windows Security dialog), the client creates a Kerberos TGS-REQ message and sends it to the KDC. In this request, the client specifies the Service Principal Name (SPN) for the Kerberos password change service: kadmin/changepw.

The KDC processes this request, verifies the user's TGT, and returns a TGS-REP containing a ticket for the kadmin/changepw service alongside an encrypted session key.

Step 2: Constructing the Password Change Request

Once the client receives the service ticket, it constructs a Kerberos password change request using the protocol defined in RFC 3244. The payload consists of:

  • An AP-REQ authenticator block containing the kadmin/changepw service ticket and an authenticator encrypted with the session key to prove identity.
  • An encrypted private data block containing the proposed new password. This data is protected using symmetric encryption derived from the subkey or session key agreed upon in the ticket exchange.

The complete request is dispatched over port 464 directly to the Domain Controller.

Step 3: Server-Side Validation and Directory Update

Upon receiving the packet on port 464, the KDC executes several verification steps:

  1. Decryption and Authentication: The KDC uses its long-term service key to decrypt the kadmin/changepw ticket, recovers the session key, and decrypts the client's authenticator and new password payload.
  2. Policy Evaluation: The Domain Controller validates the new password against Active Directory domain policies. This includes checks for password complexity, minimum and maximum password age, password length, and password history to ensure the user is not reusing an old password.
  3. Database Modification: If all policy conditions are met, the local Security Accounts Manager (SAM) and Active Directory services update the user account object. The system generates new cryptographic keys (such as NTLM hashes and Kerberos keys for DES, which was the default in Windows 2000) derived from the new password using appropriate salt mechanisms.

Step 4: Final Response

After writing the changes to the Active Directory database, the KDC constructs an AP-REP response message. If the change was successful, the message contains a success status code. If the change failed—due to policy violations, an expired session, or connectivity issues—the message contains a corresponding Kerberos error code explaining the failure (such as KRB5_KPASSWD_POLICY or KRB5_KPASSWD_AUTHERROR).

The client receives the response, decrypts the message using the established session key, and alerts the user to either the successful update or the specific reason the change was rejected. Subsequent authentication attempts immediately require the new credentials.