Enforce user logon restrictions

Applies To: Windows Server 2008, Windows Server 2008 R2

This security policy reference topic for the IT professional describes the best practices, location, values, and security considerations for this policy setting.

Reference

The Enforce user logon restrictions policy setting determines whether the Kerberos V5 Key Distribution Center (KDC) validates every request for a session ticket against the user rights policy of the user account. Validating each request for a session ticket is optional because the extra step takes time, and that can slow network access to services.

The possible values for this Group Policy setting are:

• Enabled

• Disabled

• Not defined

Best practices

1. If this policy setting is disabled, users might be granted session tickets for services that they do not have the right to use.

   It is advisable to set Enforce user logon restrictions to Enabled.

Location

GPO_name\Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy\

Default Values

Server Type or GPO	Default Value
Default Domain Policy	Enabled
Default Domain Controller Policy	Not defined
Stand-Alone Server Default Settings	Not applicable
DC Effective Default Settings	Enabled
Member Server Effective Default Settings	Not applicable
Client Computer Effective Default Settings	Not applicable

Operating system version differences

There are no differences in this policy for Windows versions beginning with Windows Server 2003.

Security considerations

This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.

Vulnerability

If you disable this policy setting, users could receive session tickets for services that they no longer have the right to use because the right was removed after they logged on.

Countermeasure

Enable the Enforce user logon restrictions setting.

Potential impact

None. This is the default configuration.