Description of Kerberos Policies in Windows 2000

ID: Q231849

The information in this article applies to:

Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Server

SUMMARY

In Windows 2000, Kerberos policy is defined at the domain level and implemented by the domain's Key Distribution Center (KDC). Kerberos policy is stored in Active Directory as a subset of the attributes of a domain security policy. By default, policy options can only be set by members of the Domain Administrators group.

MORE INFORMATION

Kerberos Policies

Enforce User Logon Restrictions

When this option is enabled, the KDC validates every request for a session ticket by examining the user rights policy on the target computer to verify that the user has the right either to log on locally or to access the computer from the network. It is also a check to ensure the requesting account is still valid. Verification is optional because the extra step takes time and may slow network access to services. The default is Enabled.

Maximum Lifetime That a User Ticket Can Be Renewed

This is the maximum lifetime of a ticket [either a Ticket Granting Ticket (TGT) or a session ticket, although the policy specifies this is for a "user ticket"]. No ticket can be renewed after this time. Default value: 7 days.

Maximum Service Ticket Lifetime

A "service ticket" is a session ticket. Settings are in minutes. The setting must be more than ten minutes and less than the setting for "Maximum user ticket lifetime." Default value: 10 hours.

Maximum Tolerance for Synchronization of Computer Clocks

When the KDC clock is this many minutes different from the Kerberos client's clock, tickets are not issued for the client. This is a deterrent in Replay attacks. Settings are in minutes. Default value: 5 minutes.

Maximum User Ticket Lifetime

A "user ticket" is a TGT and must be renewed after this time. Default value: 10 hours.

Viewing or Modifying Values

To view and make changes to these values:

Start the Microsoft Management Console (MMC).

Add the Group Policy snap-in for the default domain policy. To do this, click Browse when you are prompted to select a Group Policy Object (GPO) and then click Default Domain Policy.

Double-click to open the following sections: Computer Configuration; Windows Settings; Security Settings; Account Policies; Kerberos Policy.

Make changes as needed, but proceed with caution.

Additional query words:

Keywords : kbenv
Version : WINDOWS:2000
Platform : WINDOWS
Issue type : kbinfo