7

With MIT Kerberos, the kadmin utility supports the creation of principals that have an explicit maximum ticket lifetime and renewal lifetime (-maxlife and -maxrenewlife arguments for add_principal) which may be different than the realm's default ticket lifetime and renewal lifetime. So if your realm has a default lifetime of 24 hours and renewal lifetime of 7 days, a given principal could be 1 hour and 1 day respectively.

I'm trying to figure out whether Active Directory's Kerberos implementation supports the same thing. My gut says no, but I'm having a hard time definitively proving it other than not being able to find any obvious attributes on an account that might enable that ability.

Can anyone confirm or deny my gut answer?

Improve this question

1 Answer 1

Reset to default
3

Per my reading of it, no. It's like Password Policy - it's defined at the domain level.

http://technet.microsoft.com/en-us/library/cc757692(v=ws.10).aspx#w2k3tr_sepol_accou_set_hpjo

The policy settings under Account Policies are implemented at the domain level.

Fine-grained password policies can't be used for this, because they don't include Kerberos settings.

http://technet.microsoft.com/en-us/library/cc770394(v=ws.10).aspx

A PSO has attributes for all the settings that can be defined in the Default Domain Policy (except Kerberos settings).

Sorry to say, it appears you're out of luck.

Improve this answer
1
  • That's basically what I figured. It's unfortunate, but not the end of the world. One can hope that Microsoft adds it as a feature using the existing Fine-grained password policy system in future versions of the OS.
    – Ryan Bolger
    Aug 14, 2014 at 23:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .