1

In our company, we want to configure our Windows-based infrastructure compliant to the IASE SCAP specifications, e.g., the Microsoft Windows Server 2016 STIG Benchmark. In this document, there is the rule that Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> Enforce user logon restrictions should be Enabled.

I've searched for this settings in Windows Server 2016, Windows 10 Education, Windows 10 Enterprise, and Windows 10 Pro and it was nowhere visible ....

enter image description here

What do I have to activate or enable to see the Kerberos Policies?

Patrick Stoeckle
  • 13
  • 4

1 Answers1

2

Enforce user logon restrictions is a setting that only applies to domain controllers, not workstations or member servers. Only domain controllers issue Kerberos tickets.

What do I have to activate or enable to see the Kerberos Policies?

Enable the setting in the Default Domain Controllers Policy. (It's enabled by default). Run gpresult /h gpresult.html on a domain controller to view the settings.

Greg Askew
  • 35,880
  • 5
  • 54
  • 82