Windows Server 2025 Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-278136 | SRG-OS-000112-GPOS-00057 | WN25-DC-000050 | SV-278136r1182077_rule | 2026-02-20 | 1 |
Description
This setting determines the period of time (in days) during which a user's Ticket Granting Ticket (TGT) may be renewed. This security configuration limits the amount of time an attacker has to crack the TGT and gain access.
Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058
ℹ️ Check
This applies to domain controllers. It is not applicable for other systems.
Verify the following is configured in the Default Domain Policy:
Open "Group Policy Management".
Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain).
Right-click the "Default Domain Policy".
Select "Edit".
Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy.
If the "Maximum lifetime for user ticket renewal" is greater than "7" days, this is a finding.
✔️ Fix
Configure the policy value in the Default Domain Policy for Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> Maximum lifetime for user ticket renewal to a maximum of "7" days or less.