Kerberos Policy

Many of the settings for Kerberos are intrinsic. However, some settings can be changed. They are set through group policy and are defined at the domain level.

Five settings can be modified for Kerberos group policy. By default, they are part of the default domain policy, which can be found by right-clicking the domain in the Active Directory Users and Computers MMC Snap-in and choosing Group Policy, Edit. Kerberos settings are part of the Computer Configuration container, and the path is Windows Settings, Security Settings, Account Policies, Kerberos Policies. The following section discusses each setting, its impact, and its defaults.

Enforce User Logon Restrictions

This policy causes the KDC to check the user rights policy for ...

Get Special Edition Using Microsoft Active Directory now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.