Work out TGT renewals per session, the 7-day renewal ceiling and KDC request load from your Kerberos policy.
A ticket-granting ticket is valid for its lifetime and can be renewed repeatedly until the renewal window expires. Renewals are cheap TGS exchanges; crossing the renewal ceiling forces a full AS exchange, which needs the user's credential rather than just the existing ticket. The 10-hour default exists so a stolen ticket expires within a working day, and lengthening it to avoid mid-shift prompts extends exactly that theft window — while a machine more than five minutes out of sync fails Kerberos entirely.
Kerberos Ticket Lifetime
renewals per session = ceil(session length ÷ ticket lifetime) − 1, capped by the renewal window; beyond that window the client must authenticate again from scratch.
Clock skew tolerance
clock skew window = 2 × maximum tolerated skew, because a ticket can be either ahead of or behind the KDC clock.
renewals per session = ceil(session length ÷ ticket lifetime) − 1, capped by the renewal window; beyond that window the client must authenticate again from scratch. A ticket-granting ticket is valid for its lifetime and can be renewed repeatedly until the renewal window expires. Renewals are cheap TGS exchanges; crossing the renewal ceiling forces a full AS exchange, which needs the user's credential rather than just the existing ticket.
The 10-hour default exists so a stolen ticket expires within a working day, and lengthening it to avoid mid-shift prompts extends exactly that theft window — while a machine more than five minutes out of sync fails Kerberos entirely.
This calculator takes 5 inputs: Ticket-granting ticket lifetime, Renewal window, Typical user session length, Users authenticating per day, Maximum tolerated clock skew. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
It is chosen to outlast one working day so users are not prompted mid-shift, while guaranteeing that a stolen ticket is useless the next morning. The paired 7-day renewal window lets long-running sessions and services keep renewing for a week without ever re-sending credentials.
Authentication fails with a clock-skew error, because the KDC treats timestamps outside the tolerance as a replay attempt. This is why domain members synchronise time from the domain hierarchy and why a broken NTP source can look exactly like a total authentication outage.