UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The Kerberos policy option maximum lifetime for user ticket must be set to a maximum of 10 hours or less.


Overview

Finding ID Version Rule ID IA Controls Severity
V-2378 AD.4031_2003 SV-28498r1_rule ECSC-1 Medium
Description
In Kerberos, there are 2 types of tickets: Ticket Granting Tickets (TGTs) and Service Tickets. Kerberos tickets have a limited lifetime so the time an attacker has to implement an attack is limited. This policy controls how long TGTs can be renewed. With Kerberos, the user’s initial authentication to the domain controller results in a TGT which is then used to request Service Tickets to resources. Upon startup, each computer gets a TGT before requesting a service ticket to the domain controller and any other computers it needs to access. For services that startup under a specified user account, users must always get a TGT first, then get Service Tickets to all computers and services accessed.
STIG Date
Windows 2003 Domain Controller Security Technical Implementation Guide 2014-04-07

Details

Check Text ( None )
None
Fix Text (F-34268r1_fix)
Set the Kerberos policy option "Maximum lifetime for user ticket" to a maximum of 10 hours, but not 0 which equates to “Ticket doesn’t expire”.