does sssd store machine creds so that it can rotate a machine's password?

[Bob Green]

I've long been curious how a machine joined to a KDC/Active Directory
changes it's password periodically.  Must the machine store it's
machine password so it can be used for the equivalent of kpasswd which
prompts for the current password?  Or is there another method which
allows the machine account to change it's password as long as it can
establish credentials via it's host keytab?

[Phillip Howe]

A domain-joined machine does store a machine password. It uses this key to authenticate to AD and change the password automatically. It does not require kpasswd-like prompts or plaintext passwords. Linux/UNIX systems do the same thing through the keytab. https://geometrydash-subzero.io