changepw does not work with kadmin/changepw TGS or tgtdeleg TGT

[MexHigh]

I want to use the changepw command with a TGS for the kadmin/changepw service issued for my own user, but it does not work (however, it does work with a "normal" TGT, but this is not what i want to accomplish).

Environment

• Freshly installed Domain Controller (Windows Server 2022 21H2)
• Freshly installed Domain Client (Windows 10 21H2)

Reproduction

Executing User: LSC\lsc01 (Domain User)

1. ./Rubeus.exe asktgt /user:LSC\lsc01 /password:<redacted> /nowrap → TGT (success)
2. ./Rubeus.exe asktgs /ticket:<tgt-from-step-1> /service:kadmin/changepw /nowrap → TGS (success)
3. ./Rubeus.exe changepw /ticket:<tgs-from-step-2 /new:<new-password> → see image below

When adding the /targetuser:LSC\lsc01 option to Step 3, I get the following error message:

I've confirmed several times, that <new-password> complies with my password policy, so this is not the problem. I've also checked twice that all TGTs and TGSs are inside the validity timeframe when used in subsequent commands.

When replacing the value of the /ticket: option with a TGT issued via tgtdeleg the call also fails with the same errors.

---

Am I missing flags or anything? Thanks for your help in advance!

[darkoperator]

Microsoft extension to Kerberos for changepw requires that the ticket be an initial one. A delegated ticket is not one with that option and it can not be used for changing a password. You would need to use an Overpass technique with either password or AES Key to get an initial one or dump the users ticket and use that one from an interactive logon.

[MexHigh]

So there is no way to accomplish this without any elevation, whatsoever?