Every AD domain has an associated KRBTGT account to encrypt and sign all Kerberos tickets for the domain. The KRBTGT account should stay disabled.