The Kerberos policy option maximum lifetime for user ticket must be set to a maximum of 10 hours or less.

From Windows 2008 Domain Controller Security Technical Implementation Guide

Part of AD.4031 Kerberos - User Ticket Lifetime

Associated with IA controls: ECSC-1

SV-28499r1_rule The Kerberos policy option maximum lifetime for user ticket must be set to a maximum of 10 hours or less.

Vulnerability discussion

In Kerberos, there are 2 types of tickets: Ticket Granting Tickets (TGTs) and Service Tickets. Kerberos tickets have a limited lifetime so the time an attacker has to implement an attack is limited. This policy controls how long TGTs can be renewed. With Kerberos, the user’s initial authentication to the domain controller results in a TGT which is then used to request Service Tickets to resources. Upon startup, each computer gets a TGT before requesting a service ticket to the domain controller and any other computers it needs to access. For services that startup under a specified user account, users must always get a TGT first, then get Service Tickets to all computers and services accessed.

Check content

Fix text

Set the Kerberos policy option "Maximum lifetime for user ticket" to a maximum of 10 hours, but not 0 which equates to “Ticket doesn’t expire”.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.