The Kerberos policy is stored in Active Directory as a subset of the attributes of the domain security policy. By default, policy options can be set only by members of the Domain Administrators group. It is also a check to ensure that the requesting account is still valid. Verification is optional because the extra step takes time and may slow network access to services. No ticket can be renewed after this time.
Settings are in minutes.
The KDC server's clock and the Kerberos client's clock have to be synchronized to within a specified number of minutes. If the clocks are not synchronized within the specified number of minutes, tickets are not issued to the client. This is a deterrent in Replay attacks. Settings are in minutes. All rights reserved.