Windows 2000 Kerberos Ticket Granting in Nested Forests

This article explains how Microsoft Windows 2000 resolves authentication requests across nested forest trees using Kerberos version 5. In Windows 2000 Active Directory, hierarchical parent-child domains automatically establish transitive, two-way Kerberos trusts. When a user requests access to a service residing in a different tree within the same forest, the operating system uses a series of trust referrals along the shortest path in the domain hierarchy to issue inter-realm Ticket Granting Tickets until the client reaches the target domain's Key Distribution Center.

Trust Architecture in Windows 2000 Forests

In a Windows 2000 Active Directory forest, trust relationships between domains within a tree and between domain trees are transitive and bidirectional by default. Every child domain trusts its parent, and the roots of separate domain trees trust the forest root domain. This creates a connected, hierarchical graph of domains managed by the Key Distribution Center (KDC), which runs as part of the Active Directory service on every domain controller.

The Referral Process for Nested Trees

When a security principal requires access to a resource in a nested domain, the client cannot directly query the target domain's KDC. Instead, Windows 2000 uses Kerberos ticket referrals to traverse the domain tree hierarchy.

  1. Initial Local Request: The client requests a service ticket from its local KDC using the Service Principal Name (SPN) of the remote resource.
  2. Path Discovery: The local KDC checks its database. Because the requested SPN belongs to another domain, the KDC consults the Active Directory naming hierarchy to determine the shortest trust path to the destination domain.
  3. Issuing the Referral Ticket: The local KDC issues an inter-realm Ticket Granting Ticket (TGT), also known as a referral ticket, encrypted with the inter-realm trust key shared between the local domain and the next hop domain in the hierarchy.
  4. Traversing the Hierarchy: The client takes the referral ticket and presents it to the KDC of the next hop domain.
    • If the target is in another tree, the referral path ascends the local tree to the parent domains up to the forest root.
    • From the forest root, the path descends through the target tree from its root down to the target child domain.
    • Each intermediate KDC validates the incoming referral ticket and issues a new referral ticket for the subsequent domain in the chain.
  5. Final Service Ticket Request: Once the client reaches the KDC of the domain hosting the target resource, it presents the final referral TGT.
  6. Ticket Delivery and Access: The target domain's KDC validates the referral, generates the final service ticket encrypted with the service account's secret key, and embeds the user's Privilege Attribute Certificate (PAC) containing user and group Security Identifiers (SIDs). The client presents this service ticket to the target server for session establishment and authorization.