Specify KDC proxy servers for Kerberos clients

Supported OS tags: Windows10, Windows10RT, Windows11, Windows8, Windows81, WindowsRT, WindowsRT81, WindowsServer2012, WindowsServer2012R2, WindowsServer2016

This policy setting configures the Kerberos client's mapping to KDC proxy servers for domains based on their DNS suffix names. If you enable this policy setting, the Kerberos client will use the KDC proxy server for a domain when a domain controller cannot be located based on the configured mappings. To map a KDC proxy server to a domain, enable the policy setting, click Show, and then map the KDC proxy server name(s) to the DNS name for the domain using the syntax described in the options pane. In the Show Contents dialog box in the Value Name column, type a DNS suffix name. In the Value column, type the list of proxy servers using the appropriate syntax format. To view the list of mappings, enable the policy setting and then click the Show button. To remove a mapping from the list, click the mapping entry to be removed, and then press the DELETE key. To edit a mapping, remove the current entry from the list and add a new one with different parameters. If you disable or do not configure this policy setting, the Kerberos client does not have KDC proxy servers settings defined by Group Policy.

No explicit registry values are set for enabled or disabled states.

• Computer
  Allow retrieving the Azure AD Kerberos Ticket Granting Ticket during logon

  At least Windows Server 2019, Windows 10 Version 2004
• Computer
  Always send compound authentication first

  At least Windows Server 2012 R2, Windows 8.1 or Windows RT 8.1
• Computer
  Configure hash algorithms for certificate logon

  At least Windows 11 Version 22H2
• Computer
  Define host name-to-Kerberos realm mappings

  At least Windows Vista
• Computer
  Define interoperable Kerberos V5 realm settings

  At least Windows Vista
• Computer
  Disable revocation checking for the SSL certificate of KDC proxy servers

  At least Windows Server 2012, Windows 8 or Windows RT
• Computer
  Enable Delegated Managed Service Account logons

  At least Windows 11 Version 24H2
• Computer
  Fail authentication requests when Kerberos armoring is not available

  At least Windows Server 2012, Windows 8 or Windows RT
• Computer
  Kerberos client support for claims, compound authentication and Kerberos armoring

  At least Windows Server 2012, Windows 8 or Windows RT
• Computer
  Require strict KDC validation

  At least Windows Vista
• Computer
  Require strict target SPN match on remote procedure calls

  At least Windows Server 2008 R2 or Windows 7
• Computer
  Set maximum Kerberos SSPI context token buffer size

  At least Windows Server 2003 operating systems or Windows XP Professional