Max-Ticket-Age attribute

Article
12/14/2020

This attribute determines the maximum amount of time, in hours, that a user's ticket-granting ticket (TGT) can be used for the purpose of Kerberos authentication. When a user's TGT expires, a new one must be requested, or the existing one must be renewed. By default, this setting is set to 10 hours in the Default Domain Group Policy object (GPO).

Entry	Value
CN	Max-Ticket-Age
Ldap-Display-Name	maxTicketAge
Size	-
Update Privilege	-
Update Frequency	-
Attribute-Id	1.2.840.113556.1.4.77
System-Id-Guid	bf9679be-0de6-11d0-a285-00aa003049e2
Syntax	Interval

Windows 2000 Server

Entry	Value
Link-Id	-
MAPI-Id	-
System-Only	False
Is-Single-Valued	True
Is Indexed	False
In Global Catalog	False
NT-Security-Descriptor	O:BAG:BAD:S:
Range-Lower	-
Range-Upper	-
Search-Flags	0x00000000
System-Flags	0x00000010
Classes used in	Domain-Policy

Windows Server 2003

Entry	Value
Link-Id	-
MAPI-Id	-
System-Only	False
Is-Single-Valued	True
Is Indexed	False
In Global Catalog	False
NT-Security-Descriptor	O:BAG:BAD:S:
Range-Lower	-
Range-Upper	-
Search-Flags	0x00000000
System-Flags	0x00000010
Classes used in	Domain-Policy

Windows Server 2003 R2

Entry	Value
Link-Id	-
MAPI-Id	-
System-Only	False
Is-Single-Valued	True
Is Indexed	False
In Global Catalog	False
NT-Security-Descriptor	O:BAG:BAD:S:
Range-Lower	-
Range-Upper	-
Search-Flags	0x00000000
System-Flags	0x00000010
Classes used in	Domain-Policy

Windows Server 2008

Entry	Value
Link-Id	-
MAPI-Id	-
System-Only	False
Is-Single-Valued	True
Is Indexed	False
In Global Catalog	False
NT-Security-Descriptor	O:BAG:BAD:S:
Range-Lower	-
Range-Upper	-
Search-Flags	0x00000000
System-Flags	0x00000010
Classes used in	Domain-Policy

Windows Server 2008 R2

Entry	Value
Link-Id	-
MAPI-Id	-
System-Only	False
Is-Single-Valued	True
Is Indexed	False
In Global Catalog	False
NT-Security-Descriptor	O:BAG:BAD:S:
Range-Lower	-
Range-Upper	-
Search-Flags	0x00000000
System-Flags	0x00000010
Classes used in	Domain-Policy

Windows Server 2012

Entry	Value
Link-Id	-
MAPI-Id	-
System-Only	False
Is-Single-Valued	True
Is Indexed	False
In Global Catalog	False
NT-Security-Descriptor	O:BAG:BAD:S:
Range-Lower	-
Range-Upper	-
Search-Flags	0x00000000
System-Flags	0x00000010
Classes used in	Domain-Policy

Share via