Change Kerberos Ticket Lifetime Using Regedit

This article explains how to configure the Kerberos maximum ticket lifetime for local computer authentication using the Windows Registry Editor (regedit). While Kerberos policies are typically managed through Active Directory Group Policy Objects (GPO), modifying the registry directly allows administrators to define custom ticket lifetimes and renewal thresholds locally on a specific Windows machine.

Registry Location for Kerberos Parameters

Kerberos client configuration values are stored under the Local Security Authority (LSA) registry hive.

Step-by-Step Instructions

  1. Open Registry Editor:
    • Press Win + R, type regedit, and press Enter.
    • When prompted by User Account Control (UAC), click Yes.
  2. Navigate to the Kerberos Key:

    • In the address bar or left navigation tree, navigate to:

      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters

    • If the Parameters key does not exist under Kerberos, right-click Kerberos, select New > Key, and name it Parameters.

  3. Create or Modify Ticket Lifetime Values:
    • Right-click the empty space in the right pane, select New > DWORD (32-bit) Value, and name it MaxTicketAge.
    • Double-click MaxTicketAge, set the Base to Decimal, and enter the maximum ticket lifetime in hours (default domain policy is typically 10 hours).
    • Click OK.
  4. Configure Maximum Renewal Age (Optional):
    • To set the maximum ticket renewal period, create a new DWORD (32-bit) Value named MaxRenewAge.
    • Double-click MaxRenewAge, select Decimal, and enter the renewal lifetime in days (default is typically 7 days).
    • Click OK.
  5. Apply the Changes:

    • Close the Registry Editor.

    • Restart the computer to apply the updated Kerberos settings, or purge current tickets using the Command Prompt command:

      klist purge

Key Values Reference