KerbPurge - What is it?

When you add a computer to a group in Active Directory, the computer does not know that it has been added to the group until a reboot happens. There are many obvious reasons why this is a problem. For example, you can't just reboot production servers at any time. Most organizations have some sort process in place for scheduling server reboots which in itself can be a time consuming process. When it comes to Windows Event Collection there are many reasons for adding endpoint forwarders to groups, especially if you are using Supercharger. For example, Superchargers built-in load balanced or distributed subscription feature relies on group changes to keep forwarders balanced across the number of specified collectors. This is why Randy Franklin Smith of UltimateITSecurity.com designed and wrote KerbPurge.

Benefits and Features

• Safely and efficiently make Windows computers see group membership changes
• Tiny Windows service
• Installable via Group Policy's Software Installation feature
• Only purges tickets for the Network Service logon session and only when group membership has been changed for a computer
• No measurable resource usage

Installation and Configuration

1. Download KerbPurge from the Utilities section at LOGbinder.com and copy to a folder on your domain controller.
2. On your Domain Controller, open Group Policy Management.
3. Create a GPO in the domain.
   
4. Name the GPO and then Edit it.
5. Expand Computer Configuration\Policies\Software Settings\Software installation. Right click on Software Installation, hover over New and select Package...
   
   
6. Select the KerbPurge MSI from step 1. Click through the defaults and select "Assigned".
7. Navigate to Computer Configuration\Preferences\Windows Settings\Registry\(null)\HKEY_LOCAL_MACHINE\SOFTWARE\
8. Right click on Software and select New then Collection Item. Give it a name. In our example we did this twice so we have HKLM\Software\LOGbinder\KerbPurge.
   
   
9. Right click on the new collection and select New Registry Item. Enter the Key Path to the New Collection you just created. For value name enter "IntervalMilliseconds". Select REG_DWORD for the value type and select decimal. In our example we entered 60000 for the Value data. This is the frequency at which KerbPurge will run which determines how quickly computers will see that they are a member in a new group and a member of a new subscription.