关于AD旧静态密码账号重置方式及清除RC4的技术咨询

Hey there, let's break this down clearly based on how Active Directory handles password hashes and common real-world scenarios:

First, your core goal: Getting AES hashes & meeting password strength #

As long as your domain functional level is Windows Server 2008 or higher (standard for most modern environments), changing the password once to your new strong value will immediately generate AES-128/256 hashes for the account, alongside the legacy RC4 hash (for backward compatibility). You don’t need a double reset to get valid AES hashes—they’re created on the first password change.

Where does the "2x reset with 10-hour gap" advice come from? #

That recommendation typically ties to two specific use cases:

1. Forcing AES-only authentication: If you want to ensure no client is still relying on the old RC4 hash (to harden against RC4 vulnerabilities), waiting 10 hours (the default Kerberos TGT lifetime) between resets lets old authentication tickets expire. After the second reset, any client using the account will have to request a new ticket with the latest password’s AES hash, effectively cutting off RC4 usage.
2. Avoiding password history conflicts: If your domain’s password policy remembers multiple old passwords, a quick back-to-back reset might accidentally reuse a recently used password. But since you’re setting a brand-new strong password that hasn’t been used before, this isn’t a concern here.

Can you do back-to-back resets instead? #

Absolutely—here’s why it works:

• If your main goal is just to get a strong password with valid AES hashes, a single reset is enough.
• If you want to skip the 10-hour wait and speed up the shift to AES, reset the password twice back-to-back, then immediately push the final new password to all affected endpoints. After the second reset, any client attempting to authenticate will use the latest password’s AES hash (the previous one is now locked in password history and can’t be reused).
• Just make sure you update the password on all scheduled tasks and services right after the final reset to avoid downtime.

Quick note on your gMSA transition #

Since you’re already working on moving to gMSAs—great call! They eliminate static password headaches entirely, auto-rotate credentials, and only use AES hashes by default, so this kind of problem will disappear long-term.

备注：内容来源于stack exchange，提问作者tb1