Common Controls Hub
The Kerberos policy option Maximum lifetime for user ticket renewal must be configured for a maximum of 7 days or less.
This setting determines the period of time (in days) during which a users ticket-granting ticket (TGT) may be renewed.
Active Directory Service 2008 Security Technical Implementation Guide (STIG)
Check Text ( C-471r2_chk )
1. Analyze the system using the Security Configuration and Analysis.
2. Expand the Security Configuration and Analysis tree view.
3. Navigate to Account Policies -> Kerberos Policy.
4. If the “Maximum lifetime for user ticket renewal” is greater than ‘7’ days, then this is a finding.
Fix Text (F-5784r2_fix)
Configure the Kerberos policy option "Maximum lifetime for user ticket renewal" to a maximum of 7 days or less.