Detections
Analytics
WN25-DC-000030 - Windows Server 2025 Kerberos service ticket maximum lifetime must be limited to 600 minutes or less.
Information
This setting determines the maximum amount of time (in minutes) that a granted session ticket can be used to access a particular service. Session tickets are used only to authenticate new connections with servers. Ongoing operations are not interrupted if the session ticket used to authenticate the connection expires during the connection.Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058
Solution
Configure the policy value in the Default Domain Policy for Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> Maximum lifetime for service ticket to a maximum of '600' minutes, but not '0', which equates to 'Ticket doesn't expire'.See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_Server_2025_V1R1_STIG.zip
Item Details
Audit Name: DISA Microsoft Windows Server 2025 STIG v1r1
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-2(8), CAT|II, CCI|CCI-001941, Rule-ID|SV-278134r1182073_rule, STIG-ID|WN25-DC-000030, Vuln-ID|V-278134
Plugin: Windows
Control ID: e2283e4fb7fe9b53f9e9111d3bcbce9c5d9e3dff34ec48e4d7548fd35676fb5a