Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a nice O'Reilly book on Kerberos from our library, but it was last updated in 2003. I'm pretty sure there have been changes and improvements since then, especially with AD 2008. Are there newer books on Kerberos?


locked by HopelessN00b Jan 9 '15 at 18:22

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

closed as off-topic by HopelessN00b Jan 9 '15 at 18:22

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

changes and improvements since then - not really, actually. – Shane Madden Jul 29 '11 at 18:26
I'm with Shane - pretty certain that the Kerb portions of AD haven't (and won't) change much - neither the LDAP portion. The schema, the replication, the defaults, the things that GPOs can do - those will change with every release and service pack. But the underlying comms protocols don't need a lot of fiddling-about-with. – mfinni Jul 29 '11 at 18:28
up vote 3 down vote accepted

Couple seconds on Google after I left my comment above:

Microsoft's implementation of the Kerberos authentication protocol in Windows Vista and Windows Server 2008 includes the following features:

AES support

Improved security for Kerberos Key Distribution Centers (KDCs) located on branch office domain controllers

So, in other words, not much. Couple of differences in some implementation details, but Kerberos is still Kerberos, and will continue to be.

Actually, AES is pretty important to know about for my purposes. That is a surprisingly short list though. – jldugger Jul 29 '11 at 18:34
Sure, it could be important - but it's a change in the way MS implements their encryption of TGT and GSS messages- it's not an actual change to Kerberos, as such. – mfinni Jul 29 '11 at 19:14

Just to add to the knowledge pool there are some changes of default behaviour such as DES support is not on in Windows Server 2008 R2 onwards. See

The answer's here will really depends on people's definition of "changes and enhancements". But books wise I use the old Oreilly kerberos book and look up details on 3rd party implementations on the net as applicable (e.g. Linux vedors for details on setting up KDC etc). Use your favorite search engine or vendor support pages depending on the Kerberos implementation if its not AD.

Would this video be something you'd find useful? Doesn't focus exclusively on Kerberos but does include the detail.


Not the answer you're looking for? Browse other questions tagged or ask your own question.