With MIT Kerberos, the kadmin utility supports the creation of principals that have an explicit maximum ticket lifetime and renewal lifetime (-maxlife and -maxrenewlife arguments for add_principal) which may be different than the realm's default ticket lifetime and renewal lifetime. So if your realm has a default lifetime of 24 hours and renewal lifetime of 7 days, a given principal could be 1 hour and 1 day respectively.

I'm trying to figure out whether Active Directory's Kerberos implementation supports the same thing. My gut says no, but I'm having a hard time definitively proving it other than not being able to find any obvious attributes on an account that might enable that ability.

Can anyone confirm or deny my gut answer?


Per my reading of it, no. It's like Password Policy - it's defined at the domain level.


The policy settings under Account Policies are implemented at the domain level.

Fine-grained password policies can't be used for this, because they don't include Kerberos settings.


A PSO has attributes for all the settings that can be defined in the Default Domain Policy (except Kerberos settings).

Sorry to say, it appears you're out of luck.

  • That's basically what I figured. It's unfortunate, but not the end of the world. One can hope that Microsoft adds it as a feature using the existing Fine-grained password policy system in future versions of the OS. – Ryan Bolger Aug 14 '14 at 23:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.