Configure Kerberos Ticket Expiration via Regedit

Configuring Kerberos ticket expiration policies determines how long Ticket-Granting Tickets (TGT) and service tickets remain valid before requiring renewal or re-authentication. While these policies are typically managed across an Active Directory domain via Group Policy Objects (GPOs), you can configure local Kerberos ticket lifetime parameters directly using the Windows Registry Editor (Regedit). This guide outlines the specific registry paths, values, and steps necessary to adjust Kerberos ticket expiration settings locally.

Understanding Kerberos Expiration Registry Values

Kerberos ticket lifetime settings are controlled under the **Lsa* registry key. The key DWORD (32-bit) values used to control ticket expiration include:

• MaxTicketAge: Defines the maximum lifetime for a user ticket (TGT). The value is set in hours (Default: 10 hours).
• MaxRenewAge: Defines the maximum period during which a ticket can be renewed without re-authenticating. The value is set in days (Default: 7 days).
• MaxServiceAge: Defines the maximum lifetime for a service ticket. The value is set in minutes (Default: 600 minutes / 10 hours).
• MaxClockSkew: Defines the maximum time synchronization variance between the client and server. The value is set in minutes (Default: 5 minutes).

Step-by-Step Configuration Guide

Follow these steps to modify or create the Kerberos ticket lifetime settings in the Windows Registry:

1. Open the Registry Editor

1. Press Win + R to open the Run dialog box.
2. Type regedit and press Enter (or click OK).
3. If prompted by User Account Control (UAC), click Yes to grant administrative permissions.

2. Navigate to the Kerberos Key

In the Registry Editor address bar, navigate to the following path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters

Note: If the Parameters key does not exist under Kerberos, right-click the Kerberos folder, select New > Key, and name it Parameters.

3. Create or Modify Expiration DWORD Values

1. Right-click inside the empty space in the right pane of the Parameters key.
2. Select New > DWORD (32-bit) Value.
3. Name the value according to the parameter you want to change:
   • MaxTicketAge
   • MaxRenewAge
   • MaxServiceAge
4. Double-click the newly created DWORD value.
5. In the Edit window, select the Decimal radio button under the Base section.
6. Enter your desired duration:
   • For MaxTicketAge, enter the value in hours (e.g., 8 for 8 hours).
   • For MaxRenewAge, enter the value in days (e.g., 5 for 5 days).
   • For MaxServiceAge, enter the value in minutes (e.g., 480 for 8 hours).
7. Click OK to save the changes.

4. Apply the Changes

1. Close the Registry Editor.
2. Restart the computer or restart the Local Security Authority Subsystem Service (LSASS) to apply the updated ticket expiration policies.

Verification

To verify that the new Kerberos ticket expiration settings are functioning:

1. Open Command Prompt as an administrator.

2. Purge existing tickets by running:

   klist purge

3. Request a new ticket by accessing a network resource or running:

   klist get krbtgt

4. View the active tickets and their expiration timestamps by running:

   klist

5. Confirm that the Renew Time and End Time reflect the new intervals configured in the registry.