Windows Server 2019 Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-205705	WN19-DC-000050	SV-205705r1000143_rule		Medium

Description
This setting determines the period of time (in days) during which a user's TGT may be renewed. This security configuration limits the amount of time an attacker has to crack the TGT and gain access. Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058

STIG	Date
Microsoft Windows Server 2019 Security Technical Implementation Guide	2024-06-14

Details

Check Text ( C-5970r355033_chk )
This applies to domain controllers. It is NA for other systems. Verify the following is configured in the Default Domain Policy: Open "Group Policy Management". Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). Right-click on the "Default Domain Policy". Select "Edit". Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. If the "Maximum lifetime for user ticket renewal" is greater than "7" days, this is a finding.

Check Text ( C-5970r355033_chk )

This applies to domain controllers. It is NA for other systems.

Verify the following is configured in the Default Domain Policy:

Open "Group Policy Management".

Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain).

Right-click on the "Default Domain Policy".

Select "Edit".

Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy.

If the "Maximum lifetime for user ticket renewal" is greater than "7" days, this is a finding.

Fix Text (F-5970r355034_fix)
Configure the policy value in the Default Domain Policy for Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> "Maximum lifetime for user ticket renewal" to a maximum of "7" days or less.