windows-server-2003/ds/security/protocols/kerberos/readme.txt

*****************************************************************************
*****************************************************************************

Kerberos Configuration Keys

*****************************************************************************
*****************************************************************************

Registry entries that Kerberos is interested in:

The following are in HKLM\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters
At boot, these registry entries are read and stored in globals.  They are also
runtime configurable.

=============================================================================
Value "SkewTime" , Type REG_DWORD
Whatever it's set to will be the Skew time in minutes, default is KERB_DEFAULT_SKEWTIME minutes
#define KERB_DEFAULT_SKEWTIME           5
EXTERN TimeStamp KerbGlobalSkewTime;
This is the time difference that's tolerated between one machine and the
machine that you are trying to authenticate (dc/another wksta etc).
Units are in 10 ** 7 seconds. If this is a checked build, default in 2 hours.
=============================================================================
Value "LogLevel", Type REG_DWORD
If it's set to anything non-zero, all Kerberos errors will be logged in the
system event log. Default is KERB_DEFAULT_LOGLEVEL
#define KERB_DEFAULT_LOGLEVEL 0
KerbGlobalLoggingLevel saves this value.
=============================================================================
Value "MaxPacketSize" Type REG_DWORD
Whatever this is set to will be max size that we'll try udp with. If the
packet size is bigger than this value, we'll do tcp. Default is
KERB_MAX_DATAGRAM_SIZE bytes
#define KERB_MAX_DATAGRAM_SIZE          1500
KerbGlobalMaxDatagramSiz saves this value
=============================================================================
Value "StartupTime" Type REG_DWORD
In seconds. Wait for the specified number of seconds for the KDC to start
before giving up. Default is KERB_KDC_WAIT_TIME seconds.
#define KERB_KDC_WAIT_TIME      120
KerbGlobalKdcWaitTime saves this value.
=============================================================================
Value "KdcWaitTime" Type REG_DWORD
In seconds. Value passed to winsock as timeout for selecting a response from
a KDC. Default is KerbGlobalKdcCallTimeout seconds.
#define KERB_KDC_CALL_TIMEOUT                   10
KerbGlobalKdcCallTimeout saves this value
=============================================================================
Value "KdcBackoffTime" Type REG_DWORD
In seconds. Value that is added to KerbGlobalKdcCallTimeout each successive
call to a KDC in case of a retry. Default is KERB_KDC_CALL_TIMEOUT_BACKOFF
seconds.
#define KERB_KDC_CALL_TIMEOUT_BACKOFF           10
KerbGlobalKdcCallBackoff saves this value.
=============================================================================
Value "KdcSendRetries" Type REG_DWORD
The number of retry attempts a client will make in order to contact a KDC.
Default is KERB_MAX_RETRIES
#define KERB_MAX_RETRIES                3
KerbGlobalKdcSendRetries saves this value
=============================================================================
Value "DefaultEncryptionType" Type REG_DWORD
The default encryption type for PreAuth. As of beta3, this was
KERB_ETYPE_RC4_HMAC_OLD
#ifndef DONT_SUPPORT_OLD_TYPES
    KerbGlobalDefaultPreauthEtype = KERB_ETYPE_RC4_HMAC_OLD;
#else
    KerbGlobalDefaultPreauthEtype = KERB_ETYPE_RC4_HMAC_NT;
#endif
KerbGlobalDefaultPreauthEtype saves this value
=============================================================================
Value "FarKdcTimeout" Type REG_DWORD
Time in minutes. This timeout is used to invalidate a dc that is in the dc
cache for the Kerberos clients for dc's that are not in the same site as the
client. Default is KERB_BINDING_FAR_DC_TIMEOUT minutes.
#define KERB_BINDING_FAR_DC_TIMEOUT 10
KerbGlobalFarKdcTimeout saves this value as a TimeStamp ( 10000000 * 60 * number of minutes).
=============================================================================
Value "NearKdcTimeout" Type REG_DWORD
Time in minutes. This timeout is used to invalidate a dc that is in the dc
cache for the Kerberos clients for dcs in the same site as the
client. Default is KERB_BINDING_NEAR_DC_TIMEOUT minutes.
#define KERB_BINDING_NEAR_DC_TIMEOUT    30
KerbGlobalNearKdcTimeout saves this value as a TimeStamp ( 10000000 * 60 * number of minutes).
=============================================================================
Value "StronglyEncryptDatagram" Type REG_BOOL
Flag decides whether we do 128 bit encryption for datagram. Default is
KERB_DEFAULT_USE_STRONG_ENC_DG
#define KERB_DEFAULT_USE_STRONG_ENC_DG FALSE
KerbGlobalUseStrongEncryptionForDatagram saves this value.
=============================================================================
Value "MaxReferralCount" type REG_DWORD
Is count of how many KDC referrals client will follow before giving up.
Default is KERB_MAX_REFERRAL_COUNT = 6
KerbGlobalMaxReferralCount saves this value
=============================================================================
Value "KerbDebugLevel" type REG_DWORD
Debug log levels used in DebugLog() macro.  Default is DEB_ERROR for CHK builds
and 0 (no logging) for FRE builds.  Possible values include:

#define DEB_ERROR 		0x00000001
#define DEB_WARN		0x00000002
#define DEB_TRACE		0x00000004
#define DEB_TRACE_API           0x00000008
#define DEB_TRACE_CRED          0x00000010
#define DEB_TRACE_CTXT          0x00000020
#define DEB_TRACE_LSESS         0x00000040
#define DEB_TRACE_TCACHE        0x00000080
#define DEB_TRACE_LOGON         0x00000100
#define DEB_TRACE_KDC           0x00000200
#define DEB_TRACE_CTXT2         0x00000400
#define DEB_TRACE_TIME          0x00000800
#define DEB_TRACE_USER          0x00001000
#define DEB_TRACE_LEAKS         0x00002000
#define DEB_TRACE_SOCK          0x00004000
#define DEB_TRACE_SPN_CACHE     0x00008000
#define DEB_S4U_ERROR           0x00010000
#define DEB_TRACE_S4U           0x00020000
#define DEB_TRACE_BND_CACHE     0x00040000
#define DEB_TRACE_LOOPBACK      0x00080000
#define DEB_TRACE_TKT_RENEWAL   0x00100000
#define DEB_TRACE_U2U           0x00200000
#define DEB_TRACE_LOCKS         0x01000000
#define DEB_USE_LOG_FILE        0x02000000

These values are stored in KerbInfoLevel and KSuppInfoLevel (for common2 routines).
=============================================================================
Value "MaxTokenSize" type REG_DWORD
This sets the QCA value for maximum token size, and is used to allow QCA to 
be modified to return a value large enough for tickets containing large numbers
of groups.  It is recommended that this value remain less than 50k.

Default #define KERBEROS_MAX_TOKEN 12000

KerbGlobalMaxTokenSize stores this value.
=============================================================================
Value "SpnCacheTimeout" type REG_DWORD

Time in minutes. This timeout is used to determine the lifetime of the SPN cache 
entries.  Default is 15 minutes. On domain controllers, the default is to not cache SPNs.

Default is #define KERB_SPN_CACHE_TIMEOUT          15

KerbGlobalSpnCacheTimeout stores value as a TimeStamp ( 10000000 * 60 * number of minutes).
=============================================================================
Value "S4UCacheTimeout" type REG_DWORD

Time in minutes. This timeout is used to determine the lifetime of the S4U negative cache
entries, which are used to restrict how many S4UProxy requests hit the wire from a given
machine.

Default is #define KERB_S4U_CACHE_TIMEOUT          15

KerbGlobalS4UCacheTimeout stores value as a TimeStamp ( 10000000 * 60 * number of minutes).
=============================================================================
Value "S4UTicketLifetime" type REG_DWORD

Time in minutes. This timeout is used to determine the lifetime of tickets obtained by S4U 
proxy requests.

Default is #define KERB_S4U_TICKET_LIFETIME        15

KerbGlobalS4UTicketLifetime stores value as a TimeStamp ( 10000000 * 60 * number of minutes).
=============================================================================
Value "RetryPdc" type REG_DWORD

0 or non-zero (FALSE, or TRUE).  Determines if we'll attempt to contact the PDC 
for password expired errors for AS_REQ.

Default is FALSE.

KerbGlobalRetryPdcstores value as a BOOLEAN
=============================================================================
Value "RequestOptions" type REG_DWORD

Determines if there are additional options that need to be emitted as KdcOptions
in TGS_REQ.  Meant for future modifications of kdc options, and can be any
RFC1510 value.

Default is :

#define KERB_ADDITIONAL_KDC_OPTIONS     (KERB_KDC_OPTIONS_name_canonicalize)

KerbGlobalKdcOptions stored as a ULONG.
=============================================================================
Value "ClientIpAddresses" type REG_DWORD

0 or non-zero (FALSE, or TRUE).  Determines if we'll add in IP addresses in 
AS_REQ, thus forcing the caddr field to contain IP addresses in all tickets.

Default is FALSE, due to DHCP / NAT issues.

#define KERB_DEFAULT_CLIENT_IP_ADDRESSES 0

KerbGlobalUseClientIpAddresses value as a BOOLEAN
=============================================================================
Value "TgtRenewalTime" type REG_DWORD

Time in seconds. Determines amount of time before a TGT expires when 
kerberos will attempt to renew the ticket.  Only applies to initial TGTs.

Default is #define KERB_DEFAULT_TGT_RENEWAL_TIME 600

KerbGlobalTgtRenewalTime stores value as a TimeStamp ( 10000000 * 60 * number of minutes).
=============================================================================
Value "AllowTgtSessionKey" type REG_DWORD

0 or non-zero (FALSE, or TRUE).  Determines if we'll allow session keys to
be exported with initial, or cross realm TGTs.

Default is FALSE, due to security concerns.

KerbGlobalAllowTgtSessionKey stores value as a BOOLEAN
=============================================================================

*****************************************************************************
*****************************************************************************

KDC Configuration Keys

*****************************************************************************
*****************************************************************************

The following keys apply to the KDC only, and are located at:

HKLM\System\CurrentControlSet\Services\Kdc.  The are runtime configurable.


=============================================================================
Value "KdcUseClientAddresses" type REG_DWORD

0 or non-zero (FALSE, or TRUE).  Determines if we'll add in IP addresses in 
TGS_REP.

Default is FALSE, due to DHCP / NAT issues.

KdcUseClientAddresses stores value as a BOOLEAN.
=============================================================================
Value "KdcDontCheckAddresses" type REG_DWORD

0 or non-zero (FALSE, or TRUE).  Determines if we'll check IP addresses for
TGS_REQ vs. what's in the TGT caddr field.

Default is TRUE, meaning we won't check IP addresses, due to DHCP and NAT issues.

KdcDontCheckAddresses stores value as a BOOLEAN.
=============================================================================
Value "NewConnectionTimeout" type REG_DWORD

Time in seconds.  Determines how long after an initial TCP endpoint connection 
that we'll keep listening for data before disconnecting.

Default is 50 seconds.

KdcExistingConnectionTimeout stores value as a ULONG.
=============================================================================
Value "MaxDatagramReplySize" type REG_DWORD

Size in bytes.  Determines the upper threshold of UDP packet size in TGS_REP 
and AS_REP, before the KDC will return a KRB_ERR_RESPONSE_TOO_BIG requiring 
the client to switch to TCP.

Default is #define KERB_MAX_DATAGRAM_REPLY_SIZE          4000

KdcGlobalMaxDatagramReplySize stores value as a ULONG.
=============================================================================
Value "KdcExtraLogLevel" type REG_DWORD

ULONG flag used to determine extra KDC logging in event logs and audits.  

Values are:

#define LOG_SPN_UNKNOWN 0x1 - audit SPN unknown errors
#define LOG_PKI_ERRORS  0x2 - log detailed PKINIT errors
#define LOG_ALL_KLIN	0x4 - log all KDC errors with KLIN information.

Default is #define LOG_DEFAULT     LOG_PKI_ERRORS

KdcExtraLogLevel stores value as a ULONG.
=============================================================================
Value "KdcDebugLevel" type REG_DWORD

ULONG flag used to determine level of debug spew in DebugLog() macros.  Available
in both FRE and CHK builds.  

Values are:

#define DEB_ERROR 		0x00000001
#define DEB_WARN		0x00000002
#define DEB_TRACE		0x00000004
#define DEB_TRACE_API           0x00000008
#define DEB_TRACE_CRED          0x00000010
#define DEB_TRACE_CTXT          0x00000020
#define DEB_TRACE_LSESS         0x00000040
#define DEB_TRACE_TCACHE        0x00000080
#define DEB_TRACE_LOGON         0x00000100
#define DEB_TRACE_KDC           0x00000200
#define DEB_TRACE_CTXT2         0x00000400
#define DEB_TRACE_TIME          0x00000800
#define DEB_TRACE_USER          0x00001000
#define DEB_TRACE_LEAKS         0x00002000
#define DEB_TRACE_SOCK          0x00004000
#define DEB_TRACE_SPN_CACHE     0x00008000
#define DEB_S4U_ERROR           0x00010000
#define DEB_TRACE_S4U           0x00020000
#define DEB_TRACE_BND_CACHE     0x00040000
#define DEB_TRACE_LOOPBACK      0x00080000
#define DEB_TRACE_TKT_RENEWAL   0x00100000
#define DEB_TRACE_U2U           0x00200000
#define DEB_TRACE_LOCKS         0x01000000
#define DEB_USE_LOG_FILE        0x02000000

Default is DEB_ERROR for CHK builds, and 0 (no logging) for FRE builds.  

Additionally, the value:

#define DEB_USE_EXT_ERRORS      0x10000000

will cause the klin macros and extended information to be returned in the 
edata field of KERB_ERRORS as PKERB_EXT_ERROR.

KdcInfoLevel and KSuppinfolevel stores value as a ULONG.  KSuppInfolevel 
determines logging for common2 library.
=============================================================================