Is possession of a Kerberos .keytab file (as generated by e.g. ktpass) sufficient to 'pretend to be' that user on a windows machine? For example, create a process as, or access network resources (e.g. a share) as that user?

If so, are there tools that can demonstrate this?

FWIW - I have been able to demonstrate that possession of a .keytab file for user X:

  1. is sufficient for a client to authenticate themselves as user X to a SPNEGO web service.
  2. seems to be sufficient for that SPNEGO web service to impersonate user X (a local logon occurs) but with limited (ie impersonation, not delegation) privileges. Can I go further and actually delegate?

1 Answer 1


A Kerberos keytab file is roughly equivalent to a saved version of the relevant password. It contains the shared secret key of the service.

Therefore, someone with access to a keytab file can kinit from it and obtain Kerberos tickets of the related user (or service), just as if they had that user's password.

I'm not enough of a Windows expert to know how to demonstrate this on Windows. On Unix, you'd use something like kinit -k -t keytab_file principal_name.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.