1.3.4 Ensure 'Maximum lifetime for user ticket renewal' is set to '7 or fewer days' (STIG DC only)

Information

This security setting determines the period of time (in days) during which a user's ticket-granting ticket can be renewed.

The STIG recommended state for this setting is: 7 or fewer days

If the value for this policy setting is too high, users may be able to renew very old user ticket-granting tickets. If the value is 0, ticket-granting tickets never expire.

Solution

To establish the recommended configuration via GP, set the following UI path to 7 or fewer days :

Computer Configuration\Policies\Windows Settings\Security Settings\Account Policy\Kerberos Policy\Maximum lifetime for user ticket renewal

Impact:

None - this is the default behavior.

See Also

https://workbench.cisecurity.org/benchmarks/15301

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(13)

Plugin: Windows

Control ID: e1a7b0c0df87968705d36f2600a68e70b4ec48ac625bacdba0c7c7c27d6f0d70