ksetup.exe

File Path: C:\Windows\system32\ksetup.exe
Description: Kerberos Setup tool

Hashes

Type	Hash
MD5	`DECEF3E5B16A811A8EDC76DCCE6D7182`
SHA1	`0C4079A451D4EAA012C4611C307CA9A4D7E94B52`
SHA256	`D84EC1FCB3AB841C32EFEA8A3C821FDD7ADDBCAFC678D26620479D8C5679D2FA`
SHA384	`74F8B7B5618A88706CE926199450AD18E59333A0F255593D12AC0C5B32FC74D27C6121AB06445FCCE947A9F39E2BAE2B`
SHA512	`70EDC3CD7A30479A243E0E77A684633E1B6E1F315B205BAE0B948321A0E2849508C15DA3CB7083DFFB4F1B8E1DB912CA9F50AB08CCDF537D4357985BAFB3C23B`
SSDEEP	`768:UDgasMQOobn/BXxDvwiIHEFAQDcv1QU+bbwLYBdBVMzdLE:aoDvNcL+bgKLVWdLE`

Runtime Data

Usage (stdout):

USAGE:
/SetRealm <DnsDomainName>
	Makes this computer a member of an RFC1510 Kerberos Realm
/MapUser <Principal> [Account]
	Maps a Kerberos Principal ('*' = any principal)
	to an account ('*' = an account by same name);
	If account name is omitted, mapping is deleted 
	for the specified principal
/AddKdc <RealmName> [KdcName]
	Defines a KDC entry for the given realm.
	If KdcName omitted, DNS may be used to locate KDCs.
/DelKdc <RealmName> [KdcName]
	deletes a KDC entry for the realm.
	If KdcName omitted, the realm entry itself is deleted.
/AddKpasswd <Realmname> <KpasswdName>
	Add Kpasswd server address for a realm
/DelKpasswd <Realmname> <KpasswdName>
	Delete Kpasswd server address for a realm
/Server <Servername>
	specify name of a Windows machine to target the changes.
/SetComputerPassword <Password>
	Sets the password for the computer's domain account
	(or host principal)
/RemoveRealm <RealmName>
	delete all information for this realm from the registry.
/Domain [DomainName]
	use this domain (if DomainName is unspecified, detect it)
/ChangePassword <OldPasswd> <NewPasswd>
	Use Kpasswd to change the logged-on user's password.
	Use '*' to be prompted for passwords.
/ListRealmFlags (no args)
	Lists the available Realm flags that ksetup knows
/SetRealmFlags <realm> <flag> [flag] [flag] [...]
	Sets RealmFlags for a specific realm
/AddRealmFlags <realm> <flag> [flag] [flag] [...]
	Adds additional RealmFlags to a realm
/DelRealmFlags <realm> <flag> [flag] [flag] [...]
	Deletes RealmFlags from a realm.
/DumpState (no args)
	Analyze the kerberos configuration on the given machine.
/AddHostToRealmMap <host> <realm>
	Adds a mapping for <host> to <realm> to the registry.
/DelHostToRealmMap <host> <realm>
	Deletes existing mapping for <host> to <realm> from the registry.
/SetEncTypeAttr <domainname> <enctypes>
	Sets the encryption types trust attribute for <domain> to <enctypes> (multiple types should be separated by spaces).
	Supported encryption types are:
	  DES-CBC-CRC, DES-CBC-MD5, RC4-HMAC-MD5, 
	  AES128-CTS-HMAC-SHA1-96, AES256-CTS-HMAC-SHA1-96
/GetEncTypeAttr <domainname>
	Gets the encryption types trust attribute for <domain>.
/AddEncTypeAttr <domainname> <enctypes>
	Adds <enctypes> to the encryption types trust attribute for <domain> (multiple types should be separated by spaces).
/DelEncTypeAttr <domainname>
	Deletes the encryption types trust attribute for <domain>.

Signature

Status: Signature verified.
Serial: 33000000BCE120FDD27CC8EE930000000000BC
Thumbprint: E85459B23C232DB3CB94C7A56D47678F58E8E51E
Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

Original Filename: ksetup.exe.mui
Product Name: Microsoft Windows Operating System
Company Name: Microsoft Corporation
File Version: 10.0.14393.0 (rs1_release.160715-1616)
Product Version: 10.0.14393.0
Language: English (United States)
Legal Copyright: Microsoft Corporation. All rights reserved.

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

ksetup

Performs tasks related to setting up and maintaining Kerberos protocol and the Key Distribution Center (KDC) to support Kerberos realms. Specifically, this command is used to:

Change the computer settings for locating Kerberos realms. In non-Microsoft, Kerberosâ€“based implementations, this information is usually kept in the Krb5.conf file. In Windows Server operating systems, it’s kept in the registry. You can use this tool to modify these settings. These settings are used by workstations to locate Kerberos realms and by domain controllers to locate Kerberos realms for cross-realm trust relationships.
Initialize registry keys that the Kerberos Security Support Provider (SSP) uses to locate a KDC for the Kerberos realm, if the computer is isn’t a member of a Windows domain. After configuration, the user of a client computer running the Windows operating system can log on to accounts in the Kerberos realm.
Search the registry for the domain name of the user’s realm and then resolves the name to an IP address by querying a DNS server. The Kerberos protocol can use DNS to locate KDCs by using only the realm name, but it must be specially configured to do so.

Syntax

ksetup
[/setrealm <DNSdomainname>]
[/mapuser <principal> <account>]
[/addkdc <realmname> <KDCname>]
[/delkdc <realmname> <KDCname>]
[/addkpasswd <realmname> <KDCPasswordName>]
[/delkpasswd <realmname> <KDCPasswordName>]
[/server <servername>]
[/setcomputerpassword <password>]
[/removerealm <realmname>]
[/domain <domainname>]
[/changepassword <oldpassword> <newpassword>]
[/listrealmflags]
[/setrealmflags <realmname> [sendaddress] [tcpsupported] [delegate] [ncsupported] [rc4]]
[/addrealmflags <realmname> [sendaddress] [tcpsupported] [delegate] [ncsupported] [rc4]]
[/delrealmflags [sendaddress] [tcpsupported] [delegate] [ncsupported] [rc4]]
[/dumpstate]
[/addhosttorealmmap] <hostname> <realmname>]
[/delhosttorealmmap] <hostname> <realmname>]
[/setenctypeattr] <domainname> {DES-CBC-CRC | DES-CBC-MD5 | RC4-HMAC-MD5 | AES128-CTS-HMAC-SHA1-96 | AES256-CTS-HMAC-SHA1-96}
[/getenctypeattr] <domainname>
[/addenctypeattr] <domainname> {DES-CBC-CRC | DES-CBC-MD5 | RC4-HMAC-MD5 | AES128-CTS-HMAC-SHA1-96 | AES256-CTS-HMAC-SHA1-96}
[/delenctypeattr] <domainname>

Parameters

Parameter	Description
ksetup setrealm	Makes this computer a member of a Kerberos realm.
ksetup addkdc	Defines a KDC entry for the given realm.
ksetup delkdc	Deletes a KDC entry for the realm.
ksetup addkpasswd	Adds a kpasswd server address for a realm.
ksetup delkpasswd	Deletes a kpasswd server address for a realm.
ksetup server	Allows you to specify the name of a Windows computer on which to apply the changes.
ksetup setcomputerpassword	Sets the password for the computer’s domain account (or host principal).
ksetup removerealm	Deletes all information for the specified realm from the registry.
ksetup domain	Allows you to specify a domain (if the `<domainname>` hasn’t already been set by the /domain parameter).
ksetup changepassword	Allows you to use the kpasswd to change the logged on user’s password.
ksetup listrealmflags	Lists the available realm flags that ksetup can detect.
ksetup setrealmflags	Sets realm flags for a specific realm.
ksetup addrealmflags	Adds additional realm flags to a realm.
ksetup delrealmflags	Deletes realm flags from a realm.
ksetup dumpstate	Analyzes the Kerberos configuration on the given computer. Adds a host to realm mapping to the registry.
ksetup addhosttorealmmap	Adds a registry value to map the host to the Kerberos realm.
ksetup delhosttorealmmap	Deletes the registry value that mapped the host computer to the Kerberos realm.
ksetup setenctypeattr	Sets one or more encryption types trust attributes for the domain.
ksetup getenctypeattr	Gets the encryption types trust attribute for the domain.
ksetup addenctypeattr	Adds encryption types to the encryption types trust attribute for the domain.
ksetup delenctypeattr	Deletes the encryption types trust attribute for the domain.
/?	Displays Help at the command prompt.

Additional References

Command-Line Syntax Key