admin管理员组

文章数量:1124693

According to the Windows documentation:

The Enforce user logon restrictions policy setting determines whether the Kerberos V5 Key Distribution Center (KDC) validates every request for a session ticket against the user rights policy of the user account.

I enabled this setting and expected that, if I already had an active TGT (Ticket-Granting Ticket) and the account was then disabled or the password was expired, I would no longer be able to obtain a TS (Ticket for Service) with this TGT. However, I was still able to get a TS.

My client (from which I am sending requests) is a non-Windows client, if it matters.

Did I correctly understand this policy setting, and are my expectations reasonable? If this setting should work as I described, are there any reasons why it doesn’t work?

本文标签: