I just want to confirm behavior of Kerberos and how the tickets work, as I only have a basic understanding. From what it sounds like, the user's password hash is only used to gain the initial TGT. After that, if the TGT is valid, they are able to authorize to any TGSs they have the permissions for.

This is why a disabled/locked out account can continue to use the TGT for up to a period of time. I've heard 10 hours (when the ticket expires) or 20 minutes (not sure what the mechanic is behind this).

Does this same logic (if correct) apply to an attacker who initially signed it, obtained a TGT, and then the password is reset for that user? I can't see why changing the password of an account would stop any valid TGTs from becoming invalid, if disabling/locking that account doesn't stop it. I cannot find a concrete answer on this, so anything is much appreciated.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.