Is a keytab sufficient for logon?

Question

Is possession of a Kerberos .keytab file (as generated by e.g. ktpass) sufficient to 'pretend to be' that user on a windows machine? For example, create a process as, or access network resources (e.g. a share) as that user?

If so, are there tools that can demonstrate this?

FWIW - I have been able to demonstrate that possession of a .keytab file for user X:

1. is sufficient for a client to authenticate themselves as user X to a SPNEGO web service.
2. seems to be sufficient for that SPNEGO web service to impersonate user X (a local logon occurs) but with limited (ie impersonation, not delegation) privileges. Can I go further and actually delegate?

Answer 1

A Kerberos keytab file is roughly equivalent to a saved version of the relevant password. It contains the shared secret key of the service.

Therefore, someone with access to a keytab file can kinit from it and obtain Kerberos tickets of the related user (or service), just as if they had that user's password.

I'm not enough of a Windows expert to know how to demonstrate this on Windows. On Unix, you'd use something like kinit -k -t keytab_file principal_name.