Kerberos

The default authentication protocol in Active Directory (AD).

It uses port 88 both TCP and UDP.

It is stateless and based on tickets instead of transmitting user passwords over the network.

The tickets are issued by a Kerberos Key Distribution Centre (KDC) that resides in Domain Controllers (DCs).

Authentication Process

1. When a user logs in, their password is used to encrypt a timestamp, which is sent to the Key Distribution Centre (KDC) to verify the integrity of the authentication by decrypting it. The KDC then issues a Ticket-Granting Ticket (TGT), encrypting it with the secret key of the krbtgt account. This TGT is used to request service tickets for accessing network resources, allowing authentication without repeatedly transmitting the user’s credentials. This process decouples the user’s credentials from requests to resources.
2. The KDC service on the DC checks the authentication service request (AS-REQ), verifies the user information, and creates a Ticket Granting Ticket (TGT), which is delivered to the user.
3. The user presents the TGT to the DC, requesting a Ticket Granting Service (TGS) ticket for a specific service. This is the TGS-REQ. If the TGT is successfully validated, its data is copied to create a TGS ticket.
4. The TGS is encrypted with the NTLM password hash of the service or computer account in whose context the service instance is running and is delivered to the user in the TGS_REP.
5. The user presents the TGS to the service, and if it is valid, the user is permitted to connect to the resource (AP_REQ).