KDC support for PKInit Freshness Extension
Support for PKInit Freshness Extension requires Windows Server 2016 domain functional level (DFL). If the domain controller’s domain is not at Windows Server 2016 DFL or higher this policy will not be applied. This policy setting allows you to configure a domain controller (DC) to support the PKInit Freshness Extension. If you enable this policy setting, the following options are supported: Supported: PKInit Freshness Extension is supported on request. Kerberos clients successfully authenticating with the PKInit Freshness Extension will get the fresh public key identity SID. Required: PKInit Freshness Extension is required for successful authentication. Kerberos clients which do not support the PKInit Freshness Extension will always fail when using public key credentials. If you disable or not configure this policy setting, then the DC will never offer the PKInit Freshness Extension and accept valid authentication requests without checking for freshness. Users will never receive the fresh public key identity SID.
Policy Details
- Policy Name
- PKINITFreshness
- Registry Key
- Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters
- Supported On
- At least Windows Server 2016, Windows 10
- OMA-URI (CSP)
- ADMX_kdc/PKINITFreshnessOS Build Version:10.0.22000, 10.0.19043.1202, 10.0.19042.1202, 10.0.19041.1202CSP Version:10.0Conflict Resolution:LastWriteAllowed Editions:EnterpriseEnterprise NProfessionalProfessional NEnterprise EvaluationEnterprise N EvaluationEducationEducation NEnterprise SEnterprise S NEnterprise S EvaluationEnterprise S N EvaluationHolographic BusinessPro Single LanguagePro ChinaPro WorkstationPro Workstation NPro For EducationPro For Education NEnterprisegEnterprisegnServerrdshIotenterpriseIotenterprisesCloudeditionnCloudeditionIotenterpriseskIotenterpriseseval
- Available Languages
- en-us
Configuration Elements
PKInit Freshness Extension options:
Type: enum
- 0 Disabled
- 1 Supported
- 2 Required