I've long been curious how a machine joined to a KDC/Active Directory
changes it's password periodically. Must the machine store it's
machine password so it can be used for the equivalent of kpasswd which
prompts for the current password? Or is there another method which
allows the machine account to change it's password as long as it can
establish credentials via it's host keytab?