The Kerberos policy option must be configured to enforce user logon restrictions.

From Windows 2008 Domain Controller Security Technical Implementation Guide

Part of AD.4029 Kerberos-User Logon Restrictions

Associated with IA controls: ECSC-1

SV-28494r1_rule The Kerberos policy option must be configured to enforce user logon restrictions.

Vulnerability discussion

This policy setting determines whether the Kerberos Key Distribution Center (KDC) validates every request for a session ticket against the user rights policy of the target computer. The policy is enabled by default which is the most secure setting for validating access to target resources is not circumvented.

Check content

Fix text

Navigate to Account Policies -> Kerberos Policy and set “Enforce user logon restrictions” to "Enabled".

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.