--- title: "Kerberos — Identity Glossary | IDSync" description: "Kerberos is a network authentication protocol that uses time-bound, encrypted tickets issued by a trusted Key Distribution Center (KDC) so users and…" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://idsync.com/" }, { "@type": "ListItem", "position": 2, "name": "Glossary", "item": "https://idsync.com/glossary" }, { "@type": "ListItem", "position": 3, "name": "Kerberos", "item": "https://idsync.com/glossary/kerberos" } ] }, { "@context": "https://schema.org", "@type": "DefinedTerm", "@id": "https://idsync.com/glossary/kerberos", "name": "Kerberos", "alternateName": [ "Kerberos", "Windows Integrated Authentication" ], "description": "Kerberos is a network authentication protocol that uses time-bound, encrypted tickets issued by a trusted Key Distribution Center (KDC) so users and services can prove their identity without sending passwords over the wire — most famously the authentication engine behind Active Directory.", "url": "https://idsync.com/glossary/kerberos", "inDefinedTermSet": "https://idsync.com/glossary" } ] --- [![IDSync — identity software buyer platform](/assets/idsync-logo-BKS89EW4.png)](/) [Directory](/directory) [Compare](/compare) [Resources](/resources) [Browse tools](/directory)[Run Stack Finder](/stack-finder) 1. [Home](/) 2. [Glossary](/glossary) 3. Kerberos Authentication # Kerberos Kerberos is a network authentication protocol that uses time-bound, encrypted tickets issued by a trusted Key Distribution Center (KDC) so users and services can prove their identity without sending passwords over the wire — most famously the authentication engine behind Active Directory. Last reviewed 3 months ago Key points - Designed at MIT in the 1980s; current version is Kerberos v5 (RFC 4120). - Three parties: the client, the service, and the Key Distribution Center (KDC). The KDC issues a TGT, then per-service tickets. - Enables Single Sign-On on Windows networks — sign in once to AD, get tickets for file shares, intranet apps, SQL Server, etc. - Common attacks: Kerberoasting, AS-REP roasting, Pass-the-Ticket, Golden / Silver Tickets — heavily targeted by Mimikatz and Rubeus. - Modern alternatives for new apps: OIDC / SAML over the internet. Kerberos still dominates on-prem Windows. ## What is Kerberos? **Kerberos** is the cryptographic SSO protocol invented at MIT in the 1980s and adopted by Microsoft as the default authentication mechanism in Active Directory. When you sign into a domain-joined Windows machine and then access a file share or intranet app without re-entering your password, Kerberos is what's happening under the hood. ## How it works (simplified) 1. User signs into their workstation. The workstation sends a request to the **KDC** (the AD domain controller) for a **Ticket-Granting Ticket (TGT)**, proving identity with a password-derived key. 2. KDC returns a TGT, encrypted with the user's key. 3. To access a service (`cifs/fileserver.acme.com`), the workstation sends the TGT to the KDC and asks for a **service ticket**. 4. KDC returns a service ticket encrypted with the service's key. 5. Workstation presents the service ticket to the service. The service decrypts it, sees the user is authenticated, and grants access. The user's password never traverses the network. Tickets have short lifetimes (default 10 hours) and are bound to the requesting workstation. ## Why it still matters - **Most enterprise on-prem authentication is Kerberos** — file shares, intranet apps, SQL Server, jump hosts, SharePoint on-prem. - **Attacker playbook** — Active Directory attacks are heavily Kerberos-focused: Kerberoasting (cracking service tickets offline), AS-REP roasting, Golden Tickets (forged TGTs from KRBTGT hash), Silver Tickets (forged service tickets), Pass-the-Ticket. These are well-documented in MITRE ATT&CK. - **Hybrid environments** — Entra Connect synchronizes AD to Entra ID; many orgs still rely on Kerberos for the on-prem half. ## When buyers care - Anyone with on-prem AD — Kerberos hardening is a top ITDR / AD security project. - Migrating to cloud — Kerberos doesn't traverse the internet cleanly, so cloud apps use SAML/OIDC; you'll need Kerberos-to-SAML bridges (Okta Access Gateway, ADFS, Entra Application Proxy) for legacy apps. ## Hardening must-haves - **AES-only encryption** — disable RC4 (used in Kerberoasting). - **Strong service account passwords** — Kerberoasting cracks weak ones offline. - **gMSA / Managed Service Accounts** — eliminate human-managed service passwords. - **Protect KRBTGT** — its hash forges Golden Tickets. Rotate twice on a schedule. - **Tier-0 isolation** — KDCs / domain controllers in a separate admin tier. ## Editorial note If your AD is more than five years old and hasn't had a tier model + KRBTGT rotation + RC4 disabled, that's the place to start before any flashier ITDR purchase. ## Standards & references - [RFC 4120 — Kerberos v5](https://datatracker.ietf.org/doc/html/rfc4120) IDSync provides educational buyer guidance based on publicly available information, editorial review, and user-submitted data. Vendor information should be verified before purchase. [Who we are, our methodology & disclosure policy](/about). ### One identity concept, explained per issue Get vendor-neutral identity explainers and market updates in your inbox. Work email\* Name Company Role (optional) Interests (optional) Pick what you want more of. IAMCIAMSSO/MFAIGA/PAMSCIM/provisioningAI agent identityVendor updatesSecurity incidents Subscribe Twice-monthly identity digest. Curated, vendor-neutral. Unsubscribe any time. ### Vendor categories [iam platforms](/directory/category/iam-platforms)[itdr](/directory/category/itdr) ### Related terms [active directory](/glossary/active-directory)[ldap](/glossary/ldap)[sso](/glossary/sso)[itdr](/glossary/itdr) ### Not sure which tool you need? Run the IAM Stack Finder for a vendor-neutral shortlist tailored to your stack. [Run the Stack Finder](/stack-finder) ### Explore tools for this topic Browse vetted vendors in the iam platforms category. [Explore tools](/directory/category/iam-platforms) [![IDSync home](/assets/idsync-logo-BKS89EW4.png)](/) The buyer-focused platform for identity, access, and authentication software. #### Platform - [Home](/) - [IAM Stack Finder](/stack-finder) - [Directory](/directory) - [Resources](/resources) - [State of AI Agent Identity 2026](/reports/state-of-ai-agent-identity-2026) - [Buyer Guides](/guides) - [Glossary](/glossary) - [Newsletter](/newsletter) - [Newsletter Archive](/newsletter/archive) #### Best of guides - [All comparisons](/compare) - [All vendor alternatives](/alternatives) - [Best SSO tools](/compare/best-sso-tools) - [Best MFA tools](/compare/best-mfa-tools) - [Best PAM tools](/compare/best-pam-tools) - [Best IGA tools](/compare/best-iga-tools) - [Best CIAM tools](/compare/best-ciam-tools) - [Best passwordless auth](/compare/best-passwordless-authentication-tools) - [Best identity security](/compare/best-identity-security-tools) - [Best machine identity](/compare/best-machine-identity-tools) - [Best SaaS access governance](/compare/best-saas-access-governance-tools) - [Best developer auth](/compare/best-developer-authentication-tools) - [Best for startups](/compare/best-iam-tools-for-startups) - [Best for enterprises](/compare/best-iam-tools-for-enterprises) - [Best SCIM tools](/compare/best-scim-provisioning-tools) - [Best for AI agents](/compare/best-ai-agent-identity-tools) - [Best NHI tools](/compare/best-nhi-management-tools) - [Okta pricing explained](/guides/okta-pricing) - [Auth0 pricing explained](/guides/auth0-pricing) - [Okta alternatives](/alternatives/okta) - [Auth0 alternatives](/alternatives/auth0) #### For Vendors - [Sponsor](/sponsor) - [Badges](/badges) - [Submit Product](/submit-product) - [Claim Profile](/claim-profile) - [Partner](/partner) #### Company - [About & Methodology](/about) - [Contact](/contact) - [Privacy](/privacy) Vendor names, logos, and trademarks are the property of their respective owners. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated. Logos are displayed for identification purposes only. IDSync (idsync.com) is operated by TetraCore, Bowling Green, Ohio. It is not affiliated with the IDSync® Active Directory synchronizer by Identity Syncronizer — [learn more](/about#idsync-disambiguation). © 2026 IDSync. All rights reserved. Editorial independence. Sponsored placements are clearly disclosed.