Kerberos authentication

This page's changes and edits · All guidance changes

Microsoft's edit · 28 Apr 2025 15:27 UTC

Resolving merge conflict

Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit ea93b22 · +23 ~~−22~~ lines · also on GitHub

11 ---

2 −title: Kerberos Authentication Overview

3 −description: Learn about Kerberos authentication in Windows Server 2012 and Windows 8.

2 +title: Kerberos authentication overview in Windows Server

3 +description: Explore Kerberos authentication in Windows Server, including its protocol, benefits, interoperability, and practical applications.

44 ms.topic: concept-article

55 ms.assetid: 646c6309-e865-4be2-b415-44dd125af5c2

66 ms.author: mosagie

77 author: robinharwood

88 manager: mtillman

9 −ms.date: 10/12/2016

9 +ms.date: 04/17/2025

1010 ---

11 −# Kerberos Authentication Overview

11 +# Kerberos authentication overview in Windows Server

1212

13 −Kerberos is an authentication protocol that is used to verify the identity of a user or host. This topic contains information about Kerberos authentication in Windows Server 2012 and Windows 8.

13 +Kerberos is an authentication protocol that is used to verify the identity of a user or host. This topic contains information about Kerberos authentication in Windows Server and Windows.

1414

15 −## <a name="BKMK_OVER"></a>Feature description

16 −The Windows Server operating systems implement the Kerberos version 5 authentication protocol and extensions for public key authentication, transporting authorization data, and delegation. The Kerberos authentication client is implemented as a security support provider \(SSP\), and it can be accessed through the Security Support Provider Interface \(SSPI\). Initial user authentication is integrated with the Winlogon single sign\-on architecture.

15 +The Windows Server operating systems implement the Kerberos version 5 authentication protocol and extensions for public key authentication, transporting authorization data, and delegation. The Kerberos authentication client is implemented as a security support provider (SSP), and it can be accessed through the Security Support Provider Interface (SSPI). Initial user authentication is integrated with the Winlogon single sign-on architecture.

1716

18 −The Kerberos Key Distribution Center \(KDC\) is integrated with other Windows Server security services that run on the domain controller. The KDC uses the domain's Active Directory Domain Services database as its security account database. Active Directory Domain Services is required for default Kerberos implementations within the domain or forest.

17 +The Kerberos Key Distribution Center (KDC) is integrated with other Windows Server security services that run on the domain controller. The KDC uses the domain's Active Directory Domain Services database as its security account database. Active Directory Domain Services is required for default Kerberos implementations within the domain or forest.

1918

20 −## <a name="kerb_tr_Kerb_Benefits"></a>Practical applications

21 −The benefits gained by using Kerberos for domain\-based authentication are:

19 +## Practical applications

2220

23 −- **Delegated authentication.**

21 +The benefits gained by using Kerberos for domain-based authentication are described in the following sections.

2422

25 − Services that run on Windows operating systems can impersonate a client computer when accessing resources on the client's behalf. In many cases, a service can complete its work for the client by accessing resources on the local computer. When a client computer authenticates to the service, NTLM and Kerberos protocol provide the authorization information that a service needs to impersonate the client computer locally. However, some distributed applications are designed so that a front\-end service must use the client computer's identity when it connects to back\-end services on other computers. Kerberos authentication supports a delegation mechanism that enables a service to act on behalf of its client when connecting to other services.

23 +### Delegated authentication

2624

27 −- **Single sign on.**

25 +Services that run on Windows operating systems can impersonate a client computer when accessing resources on the client's behalf. In many cases, a service can complete its work for the client by accessing resources on the local computer. When a client computer authenticates to the service, NTLM and Kerberos protocol provide the authorization information that a service needs to impersonate the client computer locally. However, some distributed applications are designed so that a front-end service must use the client computer's identity when it connects to back-end services on other computers. Kerberos authentication supports a delegation mechanism that enables a service to act on behalf of its client when connecting to other services.

2826

29 − Using Kerberos authentication within a domain or in a forest allows the user or service access to resources permitted by administrators without multiple requests for credentials. After initial domain sign on through Winlogon, Kerberos manages the credentials throughout the forest whenever access to resources is attempted.

27 +### Single sign on

3028

31 −- **Interoperability.**

29 +Using Kerberos authentication within a domain or in a forest allows the user or service access to resources permitted by administrators without multiple requests for credentials. After initial domain sign on through Winlogon, Kerberos manages the credentials throughout the forest whenever access to resources is attempted.

3230

33 − The implementation of the Kerberos V5 protocol by Microsoft is based on standards\-track specifications that are recommended to the Internet Engineering Task Force \(IETF\). As a result, in Windows operating systems, the Kerberos protocol lays a foundation for interoperability with other networks in which the Kerberos protocol is used for authentication. In addition, Microsoft publishes Windows Protocols documentation for implementing the Kerberos protocol. The documentation contains the technical requirements, limitations, dependencies, and Windows\-specific protocol behavior for Microsoft's implementation of the Kerberos protocol.

31 +### Interoperability

3432

35 −- **More efficient authentication to servers.**

33 +The implementation of the Kerberos V5 protocol by Microsoft is based on standards-track specifications that are recommended to the Internet Engineering Task Force (IETF). As a result, in Windows operating systems, the Kerberos protocol lays a foundation for interoperability with other networks in which the Kerberos protocol is used for authentication. In addition, Microsoft publishes Windows Protocols documentation for implementing the Kerberos protocol. The documentation contains the technical requirements, limitations, dependencies, and Windows-specific protocol behavior for Microsoft's implementation of the Kerberos protocol.

3634

37 − Before Kerberos, NTLM authentication could be used, which requires an application server to connect to a domain controller to authenticate every client computer or service. With the Kerberos protocol, renewable session tickets replace pass\-through authentication. The server is not required to go to a domain controller \(unless it needs to validate a Privilege Attribute Certificate \(PAC\)\). Instead, the server can authenticate the client computer by examining credentials presented by the client. Client computers can obtain credentials for a particular server once and then reuse those credentials throughout a network logon session.

35 +### More efficient authentication to servers

3836

39 −- **Mutual authentication.**

37 +Before Kerberos, NTLM authentication could be used, which requires an application server to connect to a domain controller to authenticate every client computer or service. With the Kerberos protocol, renewable session tickets replace pass-through authentication. The server is not required to go to a domain controller,unless it needs to validate a Privilege Attribute Certificate (PAC). Instead, the server can authenticate the client computer by examining credentials presented by the client. Client computers can obtain credentials for a particular server once and then reuse those credentials throughout a network logon session.

4038

41 − By using the Kerberos protocol, a party at either end of a network connection can verify that the party on the other end is the entity it claims to be. NTLM does not enable clients to verify a server's identity or enable one server to verify the identity of another. NTLM authentication was designed for a network environment in which servers were assumed to be genuine. The Kerberos protocol makes no such assumption.

39 +### Mutual authentication

4240

43 −## See Also

44 −[Windows Authentication Overview](../windows-authentication/windows-authentication-overview.md)

41 +By using the Kerberos protocol, a party at either end of a network connection can verify that the party on the other end is the entity it claims to be. NTLM does not enable clients to verify a server's identity or enable one server to verify the identity of another. NTLM authentication was designed for a network environment in which servers were assumed to be genuine. The Kerberos protocol makes no such assumption.

42 +

43 +## Related content

44 +

45 +- [Windows Authentication Overview](/windows-server/security/windows-authentication/windows-authentication-overview)

Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 23:52 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.