Security – Export Kerberos KeyTab from Windows Root CA

Security - Export Kerberos KeyTab from Windows Root CA
February 11, 2026

KeyTab Export

To export the KeyTab from the Windows CA server, in this case it is for KeyCloak mentioned HERE

Run this in PowerShell

cd \temp ktpass -princ HTTP/server.domain.com@SERVER.DOMAIN.COM -mapuser user@DOMAIN.COM -pass '' -crypto AES256-SHA1 -ptype KRB5_NT_PRINCIPAL -out keycloak.keytab dir

This will show you the newly create KeyTab

image.png