Question

You are the IT security administrator for a small corporate network that has a single Active Directory domain named CorpNet.local. You are working on increasing the authentication security of the domain. In this lab, your task is to configure the Kerberos policy settings in the Default Domain Policy using Group Policy Management with the following settings:

Security Setting
Value
Maximum lifetime for service ticket
180 minutes
Maximum lifetime for user ticket
3 hours
Maximum lifetime for user ticket renewal
3 days
Maximum tolerance for computer clock synchronization
1 minute

What are the Kerberos policy settings that need to be configured in the Default Domain Policy using Group Policy Management?
1) Maximum lifetime for service ticket: 180 minutes
Maximum lifetime for user ticket: 3 hours
Maximum lifetime for user ticket renewal: 3 days
Maximum tolerance for computer clock synchronization: 1 minute
2) Maximum lifetime for service ticket: 180 minutes
Maximum lifetime for user ticket: 3 hours
Maximum lifetime for user ticket renewal: 3 days
3) Maximum lifetime for service ticket: 180 minutes
Maximum lifetime for user ticket: 3 hours
Maximum tolerance for computer clock synchronization: 1 minute
4) Maximum lifetime for service ticket: 180 minutes
Maximum lifetime for user ticket renewal: 3 days
Maximum tolerance for computer clock synchronization: 1 minute

Answer 1

The required Kerberos policy settings in the Default Domain Policy are: a maximum lifetime for service ticket of 180 minutes, a user ticket lifetime of 3 hours, user ticket renewal of 3 days, and a clock synchronization tolerance of 1 minute.

Step-by-step explanation:

The Kerberos policy settings that need to be configured in the Default Domain Policy using Group Policy Management for a small corporate network are as follows:

• Maximum lifetime for service ticket: 180 minutes
• Maximum lifetime for user ticket: 3 hours
• Maximum lifetime for user ticket renewal: 3 days
• Maximum tolerance for computer clock synchronization: 1 minute

These settings help improve the authentication security of the domain by setting reasonable expiration periods for both service tickets and user tickets, which are part of the Kerberos authentication protocol. The clock synchronization tolerance is crucial to prevent replay attacks due to time discrepancies.