Policy
Define interoperable Kerberos V5 realm settings
Windows 11 25H2
Policy overview
Key metadata and intent for this policy.
Supported OS tags: Windows10, Windows10RT, Windows11, Windows7, Windows8, Windows81, WindowsRT, WindowsRT81, WindowsServer2008, WindowsServer2012, WindowsServer2012R2, WindowsServer2016, WindowsVista
This policy setting configures the Kerberos client so that it can authenticate with interoperable Kerberos V5 realms, as defined by this policy setting. If you enable this policy setting, you can view and change the list of interoperable Kerberos V5 realms and their settings. To view the list of interoperable Kerberos V5 realms, enable the policy setting and then click the Show button. To add an interoperable Kerberos V5 realm, enable the policy setting, note the syntax, and then click Show. In the Show Contents dialog box in the Value Name column, type the interoperable Kerberos V5 realm name. In the Value column, type the realm flags and host names of the host KDCs using the appropriate syntax format. To remove an interoperable Kerberos V5 realm Value Name or Value entry from the list, click the entry, and then press the DELETE key. To edit a mapping, remove the current entry from the list and add a new one with different parameters. If you disable this policy setting, the interoperable Kerberos V5 realm settings defined by Group Policy are deleted. If you do not configure this policy setting, the system uses the interoperable Kerberos V5 realm settings that are defined in the local registry, if they exist.
Registry values
How enabled and disabled states update the registry.
No explicit registry values are set for enabled or disabled states.
Policy elements
Inputs and configuration options exposed by this policy.
| Element | Type | Registry mapping | Constraints & behavior |
|---|---|---|---|
Define interoperable Kerberos V5 realm settings: ID MitRealms | list | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\MitRealms\MitRealms_Enabled Type REG_MULTI_SZ | List: additive, explicit value |
Other policies in this category
Explore related policies at the same level.
- ComputerAllow retrieving the Azure AD Kerberos Ticket Granting Ticket during logonAt least Windows Server 2019, Windows 10 Version 2004
- ComputerAlways send compound authentication firstAt least Windows Server 2012 R2, Windows 8.1 or Windows RT 8.1
- ComputerConfigure hash algorithms for certificate logonAt least Windows 11 Version 22H2
- ComputerDefine host name-to-Kerberos realm mappingsAt least Windows Vista
- ComputerDisable revocation checking for the SSL certificate of KDC proxy serversAt least Windows Server 2012, Windows 8 or Windows RT
- ComputerEnable Delegated Managed Service Account logonsAt least Windows 11 Version 24H2
- ComputerFail authentication requests when Kerberos armoring is not availableAt least Windows Server 2012, Windows 8 or Windows RT
- ComputerKerberos client support for claims, compound authentication and Kerberos armoringAt least Windows Server 2012, Windows 8 or Windows RT
- ComputerRequire strict KDC validationAt least Windows Vista
- ComputerRequire strict target SPN match on remote procedure callsAt least Windows Server 2008 R2 or Windows 7
- ComputerSet maximum Kerberos SSPI context token buffer sizeAt least Windows Server 2003 operating systems or Windows XP Professional
- ComputerSpecify KDC proxy servers for Kerberos clientsAt least Windows Server 2012, Windows 8 or Windows RT