Kerberos user logon restrictions must be enforced.

From Windows Server 2008 R2 Domain Controller Security Technical Implementation Guide

Part of Kerberos-User Logon Restrictions

Associated with IA controls: ECSC-1

SV-36170r1_rule Kerberos user logon restrictions must be enforced.

Vulnerability discussion

This policy setting determines whether the Kerberos Key Distribution Center (KDC) validates every request for a session ticket against the user rights policy of the target computer. The policy is enabled by default which is the most secure setting for validating access to target resources are not circumvented.

Check content

Fix text

Set the Kerberos policy option “Enforce user logon restrictions” to ‘Enabled’

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.