Windows 2000 Domain Controller KDC Service Role

This article provides an overview of the Key Distribution Center (KDC) service on a Microsoft Windows 2000 domain controller. It covers the primary purpose of the KDC, its architectural components, how it integrates with Active Directory, and its foundational role in establishing Kerberos version 5 as the default authentication protocol in Windows networks.

The primary role of the Key Distribution Center (KDC) service running on a Microsoft Windows 2000 domain controller is to act as the centralized authority for Kerberos authentication. Windows 2000 marked a pivotal shift from the older NTLM protocol to Kerberos v5 as the primary network authentication mechanism, and the KDC is the engine that facilitates this process. It authenticates security principals (users, computers, and services) and grants tickets that allow these principals to access resources securely across the domain.

The KDC service runs within the Local Security Authority Subsystem Service (LSASS) process on every Windows 2000 domain controller and consists of two primary functional components:

1. Authentication Service (AS)

The Authentication Service handles the initial login request from a client. When a user logs on to a Windows 2000 domain, the client sends a request to the AS. The AS verifies the user's identity against the directory database and, upon successful verification, issues a Ticket-Granting Ticket (TGT). This TGT confirms the user's identity and allows them to request access to specific resources without re-entering their credentials.

2. Ticket-Granting Service (TGS)

When a client needs to access a specific network service or server, it presents the TGT to the Ticket-Granting Service. The TGS validates the TGT and issues a Service Ticket (ST) tailored specifically to the target service. The client then presents this Service Ticket directly to the resource server to gain access.

Integration with Active Directory

In standard MIT Kerberos implementations, the KDC relies on its own separate database. In Windows 2000, Microsoft integrated the KDC directly with Active Directory. Active Directory serves as the security account database, storing user accounts, passwords, and security principals. The KDC queries Active Directory to retrieve account keys and user privileges, allowing seamless, single sign-on (SSO) authentication across the entire enterprise network.