1.3.4 Ensure 'Maximum lifetime for user ticket renewal' is set to '7 or fewer days' (STIG DC only)

Information

This security setting determines the period of time (in days) during which a user's ticket-granting ticket can be renewed.

The STIG recommended state for this setting is: 7 or fewer days

If the value for this policy setting is too high, users may be able to renew very old user ticket-granting tickets. If the value is 0, ticket-granting tickets never expire.

Solution

To establish the recommended configuration via GP, set the following UI path to 7 or fewer days :

Computer Configuration\Policies\Windows Settings\Security Settings\Account Policy\Kerberos Policy\Maximum lifetime for user ticket renewal

Impact:

None - this is the default behavior.

See Also

https://workbench.cisecurity.org/benchmarks/15105

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(13)

Plugin: Windows

Control ID: 1d619287a5b13a3d8b0785b61f1c06894b2086d590c88bdccee4ee6f3af23bbb