Kerberos Authentication

Kerberos is the default authentication protocol in Active Directory since Windows 2000, replacing the older and weaker NTLM challenge-response scheme for domain-joined clients and servers. It is a ticket-based system built around a trusted third party, the Key Distribution Center (KDC), which runs on every domain controller and issues time-limited, cryptographically signed tickets instead of transmitting passwords or password hashes across the network. Because tickets carry a short lifetime (10 hours by default for a Kerberos ticket-granting ticket, renewable for up to 7 days) and are bound to the requesting principal, replaying a captured ticket has a limited window of usefulness compared to replaying an NTLM hash.

Authentication begins when a client sends an AS-REQ (Authentication Service Request) to the KDC's Authentication Service, proving knowledge of its password by encrypting a timestamp with a key derived from it; the KDC responds with an AS-REP containing a Ticket-Granting Ticket (TGT) encrypted with the krbtgt account's secret key. The client then presents that TGT to the Ticket-Granting Service (TGS-REQ) whenever it needs to access a specific resource, such as a file share or SQL Server instance identified by a Service Principal Name (SPN), and receives back a service ticket (TGS-REP) that only the target server can decrypt. This two-step design means the user's actual password-derived key is used only once, during the initial AS exchange, minimizing its exposure on the wire.

Every Kerberos ticket embeds a session key, timestamps, and a Privilege Attribute Certificate (PAC) that lists the user's group memberships and security identifiers so the target server can build an access token without an extra round trip to a domain controller. Modern domains should be configured to use AES256-CTS-HMAC-SHA1-96 for ticket encryption rather than the legacy RC4-HMAC (equivalent to NTLM's hash), which is still enabled by default in many environments and is a favorite target for offline cracking once a ticket is captured. Administrators can inspect a machine's current ticket cache with the klist command, and can force a specific encryption type on a service account using the msDS-SupportedEncryptionTypes attribute.

Because Kerberos ticket validity depends on synchronized clocks, a time skew beyond the default five-minute tolerance between a client and the KDC produces a KRB_AP_ERR_SKEW error and blocks authentication entirely, which is why domain controllers are the authoritative time source for a Windows domain via the Win32Time hierarchy. Another classic failure mode is the 'double-hop problem,' where a user authenticates to a front-end server that then needs to pass those same credentials to a back-end resource on the user's behalf; without delegation configured (constrained or resource-based constrained delegation), the second hop silently falls back to NTLM or fails. Duplicate or stale Service Principal Names registered on the wrong account also cause KDC_ERR_S_PRINCIPAL_UNKNOWN or ambiguous SPN errors that block clients from requesting a service ticket at all.