I have an Active Directory with a KDC running on Windows Server 2012.
At the moment, every user can request service tickets for every service from the TGS. I'm looking for a solution where the KDC only grants a service ticket for service X if the user is in group Y or something similiar.
Is that possible with Active Directory?