Why is KRBTGT account in Windows Sever 2003 disabled?

The reason that the KRBTGT account is disabled in Windows 2000/2003 Server is that there is no reason or need for someone to be logging in with the KRBTGT domain account. Therefore, it cannot be enabled. Because it is a built-in account, you cannot enable or rename KRBTGT account. If  you try to rename the account you will get the error:

One of the names could not be changed due to the following problem: Cannot perform this operation on built-in accounts. Please try again.

If you try to enable the account you will get the error:

Krbtgt could not be enabled due to the following problem: Cannot perform this operation on built-in accounts.

Kerberos is the default authentication protocol in Windows 2000/2003. The KRBTGT account is used for Kerberos Ticket Granting Ticket (TGT). TGT  is a ticket that must be presented to the Kerberos service when a session request is made. The TGT is enciphered with a key that is derived from the password of the KRBTGT account, which is known only to the Kerberos service. As administrators we don't need to mess with this account.