Maximum lifetime for user ticket

This security setting determines the maximum amount of time (in hours) that a user's ticket-granting ticket (TGT) may be used.

Policy path: 

Computer Configuration\Windows Settings\Local Policies\Kerberos Policy


clients will get the new setting after a maximum of 8 hours but for DCs to assign these new settings a Gpupdate /force is required or waiting for the usual 5 minutes when the SCE engine assigns all modified settings.


10 hours.

Supported on: 

At least Windows XP SP2, Windows Server 2003

Registry settings: 

Kerberos Policy security settings are not registry keys.

Reboot required: 


Related content