Our domain's Kerberos ticket lifetime is currently set to seven days, although this predates my time at the company and I'm not sure why. I'm considering changing it back to the usual 10-hour setting. Most information I've found discusses extending the lifetime rather than shortening it. We have a sizable Linux presence, so I'd like to understand whether reducing the lifetime could cause authentication or operational issues. Has anyone made a similar change, and what impact did you see?
3 Answers
Most clients should automatically obtain a new ticket when the current one expires. The main practical effect is a small increase in authentication traffic to the domain controllers, but that’s generally negligible since clients already request service tickets throughout the day. Systems should handle expiration normally because Kerberos tickets are designed to expire. If a platform breaks when renewing tickets, that points more to a client implementation problem than to the shorter lifetime itself.
Linux clients using standard Kerberos libraries should renew or reacquire tickets as needed, provided their time synchronization and credential configuration are working correctly. Before changing the policy broadly, test it with a few Linux and Windows systems and monitor domain-controller authentication load and any renewal errors.
I had understood the default lifetime to be seven days, so it’s worth checking which Kerberos setting you’re looking at. The ticket-granting ticket lifetime and the lifetime of individual service tickets can have different defaults depending on the operating system and domain policy.
For most environments, something in the four-to-10-hour range is reasonable. I’ve also seen tightly controlled, smaller networks use one-hour lifetimes when the domain controllers were sized appropriately and placed behind load balancing.