Policy
Define host name-to-Kerberos realm mappings
Windows 11 25H2
Policy overview
Key metadata and intent for this policy.
Supported OS tags: Windows10, Windows10RT, Windows11, Windows7, Windows8, Windows81, WindowsRT, WindowsRT81, WindowsServer2008, WindowsServer2012, WindowsServer2012R2, WindowsServer2016, WindowsVista
This policy setting allows you to specify which DNS host names and which DNS suffixes are mapped to a Kerberos realm. If you enable this policy setting, you can view and change the list of DNS host names and DNS suffixes mapped to a Kerberos realm as defined by Group Policy. To view the list of mappings, enable the policy setting and then click the Show button. To add a mapping, enable the policy setting, note the syntax, and then click Show. In the Show Contents dialog box in the Value Name column, type a realm name. In the Value column, type the list of DNS host names and DNS suffixes using the appropriate syntax format. To remove a mapping from the list, click the mapping entry to be removed, and then press the DELETE key. To edit a mapping, remove the current entry from the list and add a new one with different parameters. If you disable this policy setting, the host name-to-Kerberos realm mappings list defined by Group Policy is deleted. If you do not configure this policy setting, the system uses the host name-to-Kerberos realm mappings that are defined in the local registry, if they exist.
Registry values
How enabled and disabled states update the registry.
No explicit registry values are set for enabled or disabled states.
Policy elements
Inputs and configuration options exposed by this policy.
| Element | Type | Registry mapping | Constraints & behavior |
|---|---|---|---|
Define host name-to-realm mappings: ID hosttorealm | list | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\domain_realm\domain_realm_Enabled Type REG_MULTI_SZ | List: additive, explicit value |
Other policies in this category
Explore related policies at the same level.
- ComputerAllow retrieving the Azure AD Kerberos Ticket Granting Ticket during logonAt least Windows Server 2019, Windows 10 Version 2004
- ComputerAlways send compound authentication firstAt least Windows Server 2012 R2, Windows 8.1 or Windows RT 8.1
- ComputerConfigure hash algorithms for certificate logonAt least Windows 11 Version 22H2
- ComputerDefine interoperable Kerberos V5 realm settingsAt least Windows Vista
- ComputerDisable revocation checking for the SSL certificate of KDC proxy serversAt least Windows Server 2012, Windows 8 or Windows RT
- ComputerEnable Delegated Managed Service Account logonsAt least Windows 11 Version 24H2
- ComputerFail authentication requests when Kerberos armoring is not availableAt least Windows Server 2012, Windows 8 or Windows RT
- ComputerKerberos client support for claims, compound authentication and Kerberos armoringAt least Windows Server 2012, Windows 8 or Windows RT
- ComputerRequire strict KDC validationAt least Windows Vista
- ComputerRequire strict target SPN match on remote procedure callsAt least Windows Server 2008 R2 or Windows 7
- ComputerSet maximum Kerberos SSPI context token buffer sizeAt least Windows Server 2003 operating systems or Windows XP Professional
- ComputerSpecify KDC proxy servers for Kerberos clientsAt least Windows Server 2012, Windows 8 or Windows RT