Kerberos for the Busy Admin

re: Kerberos for the Busy Admin

sunilnair4u — Fri, 07 Mar 2008 06:59:25 GMT

Very well written, concise article for an admin. Thanks Rob!

re: Kerberos for the Busy Admin

Scharique — Fri, 07 Mar 2008 23:32:42 GMT

Very informative article. It just so happen that I had an infamous Event ID 4 Kerberos error on one of my DC yesterday and I was looking up for all the basics/advanced bits of Kerberos. Thanks

Troubleshooting Kerberos Authentication problems – Name resolution issues

Ask the Directory Services Team — Wed, 14 May 2008 19:49:15 GMT

Hi Rob here. I thought I would show you how we in Microsoft Commercial Technical Support typically troubleshoot

Kerberos Authentication problems – Service Principal Name (SPN) issues - Part 1

Ask the Directory Services Team — Thu, 29 May 2008 20:50:26 GMT

Hi Rob here again. I hope that you found the first blog on troubleshooting Kerberos Authentication problems

Kerberos Authentication problems – Service Principal Name (SPN) issues - Part 3

Ask the Directory Services Team — Wed, 11 Jun 2008 21:30:32 GMT

Now we have seen what it looks like when there is no Service Principal Name defined , and when the Service

Understanding Kerberos Double Hop

Ask the Directory Services Team — Fri, 13 Jun 2008 20:13:41 GMT

Hi, Steve here. Kerberos Double Hop is a term used to describe our method of maintaining the client's

Interesting Links - 6/18/2008

Matt Johnson's Technical Adventures — Wed, 18 Jun 2008 15:32:59 GMT

To DEP or not to DEP – A good post on DEP from the Performance Team Windows XP era draws to a close –

re: Kerberos for the Busy Admin

JMRoderick — Tue, 01 Jul 2008 11:48:31 GMT

If a user account is disabled after is has been granted a ticket to access, say, a file on a file server, what happens? Is access revoked immediately or not until the ticket expires (which could be 10 hours time)?

Thanks.

re: Kerberos for the Busy Admin

NedPyle — Tue, 01 Jul 2008 16:26:38 GMT

The user will still have access until the TGT expires. In this scenario where a user is (presumably) being terminated, they should be logged off of their workstation to destroy any existing kerberos tickets. If the environment is high security and needs an even faster turnaround time, Smart Cards should be used instead - in that case the smart card certificate for that user should be revoked in order to get instant gratification.

- Ned

re: Kerberos for the Busy Admin

robert5150 — Tue, 26 Aug 2008 06:44:35 GMT

Hey Guys,

I am unclear on what this means:

The KDC then creates the service ticket with the following information within it:

""Once the service ticket information is compiled the entire service ticket is encrypted with the Services User Key (password hash). ""

Please Advise...

Thnak You

Robert

re: Kerberos for the Busy Admin

robert5150 — Tue, 26 Aug 2008 07:03:09 GMT

Another question....

What is the difference between a session key and a TGT? I though that once you had a TGT you basically

had a session key?

I thought they were the same...

Thanks...

Robert

re: Kerberos for the Busy Admin

Rob Greene — Wed, 27 Aug 2008 18:35:14 GMT

Hey Robert,

So lets see if I can answer both your questions.

"Once the service ticket information is compiled the entire service ticket is encrypted with the Services User Key (password hash)."

This means that the KDC is going to encrypt the Service Ticket with the services password that has to decrypt the ticket.

So in a scenario, you want to access a UNC file share. The KDC is going to encrypt the TGS with the File Servers Password hash. Keep in mind that the TGS is not consumed by you or the machine you are logged onto. The TGS is consumed by the resource you are attempting to authenticate to. In this example the file server machine password since the Server services runs as LocalSystem.

Session keys:

Session keys are used between the systems to typically to encrypt the data. So when we are talking about a session key for the TGT. The client encrypts data for use by the KDC using the Session key. A copy of the session key is stored in the TGT that only the KDC can decrypt. Once the KDC can decrypt the TGT he has access to the session key and can therefore decyrpt the other encrypted data from the client.

You have the same concept of this with Service Tickets.

from the blog: "The TGS generates a Unique Service Session Key. This session key is going to be used by the principal and service."

Most of the time when you are working with Kerberos Authentication you do not need to be overly concerned about session keys. Thats why it is covered here down in the lower bullets.

I hope that I have been able to answer your questions Robert.

Rob Greene

Links for 2008-10-20 [del.icio.us]

Mirrored Blogs — Tue, 21 Oct 2008 08:39:25 GMT

A Very Fast Method to Get the Site Collection’s Web Structure « SharePoint Internals - Hristo

Kerbie Goes to Monte Carlo (a.k.a. Information on configuring and troubleshooting Kerberos)

SharePoint Thinks, Links and Clinks — Mon, 19 Jan 2009 00:00:38 GMT

  Kerberos for the busy admin http://blogs.technet.com/askds/archive/2008/03/06/kerberos-for-the-busy-admin.aspx

Seeing the Domains through the forest: What you need to know to build your career in Directory Services technologies

Ask the Directory Services Team — Fri, 30 Jan 2009 17:15:13 GMT

Hi, Steve again. I thought I would speak through a series of posts about what knowledge is critical to

Kerberos for the Busy Admin

re: Kerberos for the Busy Admin

re: Kerberos for the Busy Admin

Troubleshooting Kerberos Authentication problems – Name resolution issues

Kerberos Authentication problems – Service Principal Name (SPN) issues - Part 1

Kerberos Authentication problems – Service Principal Name (SPN) issues - Part 3

Understanding Kerberos Double Hop

Interesting Links - 6/18/2008

re: Kerberos for the Busy Admin

re: Kerberos for the Busy Admin

re: Kerberos for the Busy Admin

re: Kerberos for the Busy Admin

re: Kerberos for the Busy Admin

Links for 2008-10-20 [del.icio.us]

Top AskDS Blog Posts

Kerbie Goes to Monte Carlo (a.k.a. Information on configuring and troubleshooting Kerberos)

Seeing the Domains through the forest: What you need to know to build your career in Directory Services technologies