When the krbtgt password was last changed

#Requires -Modules ActiveDirectory
# Password age of this domain's krbtgt account (well-known RID 502). Read-only.

$domain = Get-ADDomain
$krbtgt = Get-ADUser -Identity "$($domain.DomainSID)-502" -Properties PasswordLastSet

[pscustomobject]@{
    Domain          = $domain.DNSRoot
    Account         = $krbtgt.SamAccountName
    PasswordLastSet = $krbtgt.PasswordLastSet
    DaysSinceChange = [int]((Get-Date) - $krbtgt.PasswordLastSet).TotalDays
}

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Where to run it

A domain-joined machine with the Active Directory module (RSAT) installed.

Reading the output

• Finds the account by its well-known SID (domain SID followed by -502), so it works whatever the account is called.
• This only reads the date. Microsoft's guidance for resetting the krbtgt password is to do it twice, waiting at least 10 hours (the default maximum ticket lifetime) between the two resets.
• Run it in each domain; every domain has its own krbtgt account.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.