From my GitHub Repo: Get-PSADForestKRBTGTInfo
This function discovers all of the KRBTGT accounts in the forest using ADSI and returns the account info, specifically the last password change.
Currently, the script performs the following actions:
* Queries a Global Catalog in the Active Directory root domain for all KRBTGT accounts in the forest by querying the Global Catalog for SPN info.
* Provides information about all of the KRBTGT accounts in the forest, specifically the last password change.
REQUIRES: Active Directory user authentication. Standard user access is fine – admin access is not necessary.