Kerberos authentication
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 941263f · +12 −1 lines · also on GitHub
⋯ 3 unchanged lines
44
ms.topic: concept-article
55
ms.author: roharwoo
66
author: robinharwood
7
−ms.date: 07/17/2025
7
+ms.date: 09/14/2026
8
+ai-usage: ai-assisted
89
---
910
# Kerberos authentication overview in Windows Server
1011
⋯ 2 unchanged lines
1314
The Windows Server operating systems implement the Kerberos version 5 authentication protocol and extensions for public key authentication, transporting authorization data, and delegation. The Kerberos authentication client is implemented as a security support provider (SSP), and it can be accessed through the Security Support Provider Interface (SSPI). Initial user authentication is integrated with the Winlogon single sign-on architecture.
1415
1516
The Kerberos Key Distribution Center (KDC) is integrated with other Windows Server security services that run on the domain controller. The KDC uses the domain's Active Directory Domain Services database as its security account database. Active Directory Domain Services is required for default Kerberos implementations within the domain or forest.
17
+
18
+## How Kerberos authentication works
19
+
20
+Kerberos authentication involves three parties: the client that acts for a security principal, the service the principal wants to reach, and the Key Distribution Center (KDC) that both parties trust. A *security principal* is an identity, such as a user, computer, or service, that the system can authenticate. In Windows Server, the KDC runs on every domain controller and uses the domain's Active Directory Domain Services database as its account database.
21
+
22
+When a user signs in, the Kerberos client contacts the KDC to prove the user's identity and obtain a ticket-granting ticket (TGT). The TGT is a credential that lets the client request access to services without presenting the user's password again. The client stores the TGT in its ticket cache and reuses it until the ticket expires.
23
+
24
+To connect to a service, the client presents its TGT to the KDC and requests a service ticket for that specific service. The KDC returns a service ticket, which the client presents directly to the target service. Because the ticket already contains the information that the service needs to verify the client's identity, the service can authenticate the client without contacting a domain controller for each connection.
25
+
26
+Windows Server implements the industry-standard Kerberos version 5 protocol that the Internet Engineering Task Force (IETF) defines. This standards-track foundation lets the Windows implementation interoperate with other systems that use Kerberos. On top of the standard, Windows adds extensions for public key authentication, transporting authorization data, and delegation. Microsoft documents these Windows-specific behaviors in the Windows Protocols specification [[MS-KILE]: Kerberos Protocol Extensions](/openspecs/windows_protocols/ms-kile/2a32282e-dd48-4ad9-a542-609804b02cc9), which describes where the Windows implementation extends or differs from the standard.
1627
1728
## Practical applications
1829
⋯ 29 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 23:52 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.