Windows Server 2022 Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-254389 | WN22-DC-000050 | SV-254389r1051104_rule | Medium |
| Description |
| This setting determines the period of time (in days) during which a user's Ticket Granting Ticket (TGT) may be renewed. This security configuration limits the amount of time an attacker has to crack the TGT and gain access. Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058 |
| STIG | Date |
| Microsoft Windows Server 2022 Security Technical Implementation Guide | 2025-01-14 |
Details
| Check Text (C-57874r848981_chk) |
| This applies to domain controllers. It is NA for other systems. Verify the following is configured in the Default Domain Policy: Open "Group Policy Management". Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). Right-click on the "Default Domain Policy". Select "Edit". Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. If the "Maximum lifetime for user ticket renewal" is greater than "7" days, this is a finding. |
| Fix Text (F-57825r848982_fix) |
| Configure the policy value in the Default Domain Policy for Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> Maximum lifetime for user ticket renewal to a maximum of "7" days or less. |