Kerberos authentication
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 3c70438 · +3 −3 lines · also on GitHub
⋯ 4 unchanged lines
55
ms.assetid: 646c6309-e865-4be2-b415-44dd125af5c2
66
ms.author: mosagie
77
author: meaghanlewis
8
−ms.date: 07/14/2025
8
+ms.date: 07/17/2025
99
---
1010
# Kerberos authentication overview in Windows Server
1111
⋯ 21 unchanged lines
3333
3434
### More efficient authentication to servers
3535
36
−Before Kerberos, NTLM authentication could be used, which requires an application server to connect to a domain controller to authenticate every client computer or service. With the Kerberos protocol, renewable session tickets replace pass-through authentication. The server is not required to go to a domain controller,unless it needs to validate a Privilege Attribute Certificate (PAC). Instead, the server can authenticate the client computer by examining credentials presented by the client. Client computers can obtain credentials for a particular server once and then reuse those credentials throughout a network logon session.
36
+Before Kerberos, NTLM authentication could be used, which requires an application server to connect to a domain controller to authenticate every client computer or service. With the Kerberos protocol, renewable session tickets replace pass-through authentication. The server is not required to go to a domain controller, unless it needs to validate a Privilege Attribute Certificate (PAC). Instead, the server can authenticate the client computer by examining credentials presented by the client. Client computers can obtain credentials for a particular server once and then reuse those credentials throughout a network logon session.
3737
3838
### Mutual authentication
3939
⋯ 1 unchanged line
4141
4242
## Encryption types
4343
44
−Beginning with Windows Server 2025, Kerberos no longer honors the legacy registry key `REG_DWORD SupportedEncryptionTypes` found in the path **HKEY_LOCAL_MACHINE\CurrentControlSet\Control\Lsa\Kerberos\Parameters**. Microsoft recommends using group policy instead. To learn more about the group policy settings, see [Network security: Configure encryption types allowed for Kerberos](https://learn.microsoft.com/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos).
44
+Beginning with Windows Server 2025, Kerberos no longer honors the legacy registry key `REG_DWORD SupportedEncryptionTypes` found in the path **HKEY_LOCAL_MACHINE\CurrentControlSet\Control\Lsa\Kerberos\Parameters**. Microsoft recommends using group policy instead. To learn more about the group policy settings, see [Network security: Configure encryption types allowed for Kerberos](/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos).
4545
4646
## Related content
4747
⋯ 1 unchanged line
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 23:52 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.