Kerberos TGS Requests in Windows 2000

In Microsoft Windows 2000, the operating system introduced Kerberos version 5 as its core network authentication protocol, handled primarily through the Active Directory Key Distribution Center (KDC). Once a user successfully authenticates and receives an initial Ticket Granting Ticket (TGT), the Ticket Granting Service (TGS) manages requests for specific network resources by validating client credentials and issuing target-specific Service Tickets containing user authorization data.

The Role of the KDC in Windows 2000

In Windows 2000, the KDC runs as an integrated service on every Active Directory Domain Controller (DC). The KDC is divided into two primary subcomponents: the Authentication Service (AS) and the Ticket Granting Service (TGS). While the AS issues the initial TGT upon logon, the TGS handles all subsequent authorization requests when a user needs to communicate with network services such as file shares, print queues, or SQL servers.

The TGS Request Process (KRB_TGS_REQ)

When a client application requires access to a target service, the Windows 2000 Kerberos security provider checks the local ticket cache. If no valid Service Ticket exists for the target Service Principal Name (SPN), the client submits a KRB_TGS_REQ message to port 88 on a Domain Controller. This request contains:

  • The TGT: The ticket previously issued by the AS, encrypted using the domain's Key Distribution Center account (krbtgt) secret key.
  • An Authenticator: A timestamped block of data encrypted with the client/TGS session key established during initial logon, proving the request originated from the legitimate user.
  • The Target SPN: The unique identity of the service the user is attempting to access.

Validation and Authorization via the PAC

Upon receiving the KRB_TGS_REQ, the Windows 2000 KDC performs several verification and generation steps:

  1. Ticket Decryption: The KDC uses the krbtgt account key to decrypt the incoming TGT, extracting the embedded session key and verifying that the TGT has not expired.
  2. Identity Verification: Using the extracted session key, the KDC decrypts the Authenticator to confirm that the client's identity and timestamp match the information in the TGT.
  3. Privilege Attribute Certificate (PAC) Handling: Windows 2000 augments standard Kerberos v5 with the PAC, an authorization payload containing the user's Security Identifier (SID) and group memberships. The TGS extracts the PAC from the TGT, updates any necessary authorization information, and prepares it for inclusion in the new ticket.
  4. Service Key Lookup: The KDC searches Active Directory for the account associated with the requested SPN to retrieve that account's secret key.

The TGS Response (KRB_TGS_REP)

Once validation is complete, the KDC constructs two distinct components delivered in a KRB_TGS_REP message back to the client:

  • The Service Ticket: This ticket contains the client's identity, the updated PAC, and a newly generated service session key. The entire ticket is encrypted with the secret key of the target service host, meaning the client cannot read or modify its contents.
  • Client Session Data: The newly generated service session key, encrypted with the client/TGS session key so only the client can read it.

Service Access

Upon receiving the response, the Windows 2000 client decrypts its copy of the service session key and stores the Service Ticket in its local memory cache. The client then formats an application request (KRB_AP_REQ) containing the Service Ticket and sends it directly to the target server. The target server decrypts the ticket using its own local machine or service account key, verifies the PAC to determine access rights, and establishes a secure session without contacting the Domain Controller again.