Active Directory and Kerberos Integration
Understand how Microsoft Active Directory implements Kerberos and manages the Key Distribution Center.
Active Directory as KDC
Microsoft Active Directory implements Kerberos 5 as its primary authentication protocol. Each Windows domain controller runs the KDC service, which includes both the Authentication Service and Ticket Granting Service. The domain name maps directly to the Kerberos realm name, and domain accounts correspond to Kerberos principals.
Domain Controller KDC Role
In an Active Directory domain, every domain controller can serve as a KDC, with replication ensuring consistent principal information across all DCs. The krbtgt account, whose password hash is the master secret for TGT encryption, exists in every domain. Its security is critical: compromise allows forging TGTs for any principal.
All lessons in this course
- Kerberos Architecture and Ticket Flow
- Active Directory and Kerberos Integration
- Kerberos Attack Techniques: Kerberoasting and Golden Ticket
- Modern Identity: SAML, OIDC, and Hybrid Approaches