It works alongside the Kerberos authentication service which is used in AD to authenticate users and computers within a domain. Specifically it allows users to change their passwords securely via Kerberos.

The kpasswd service ensures that the password change is done in a way that preserves the security of the Kerberos tickets and the user's ability to authenticate within the AD domain.

Left-click: follow link, Right-click: select node, Scroll: zoom