# Key Distribution Center

## Overview

The Key Distribution Center (KDC) is implemented as a *domain service*.

KDC uses the Active Directory as its [*account database*](https://jackx8x7x.gitbook.io/security-stuff/windows/adds#account-database) and the Global Catalog for directing referrals to KDCs *in other domains*. The *encryption* key used in communicating with a user, computer, or service is stored *as an attribute of the account object of that security principal*.

Both Active Directory and KDC run as part of the LSA's process on a *domain controller*.

The KDC is a single process that provides two services: *Authentication and Ticket-Granting service*.

{% embed url="<https://learn.microsoft.com/en-us/windows/win32/secauthn/key-distribution-center>" %}

### Authentication Service (AS)

This service issues [ticket-granting tickets](https://jackx8x7x.gitbook.io/security-stuff/auth/kerberos#as-exchange) (TGTs).

### Ticket-Granting Service (TGS)

When clients want access to a computer, they contact the [ticket-granting service](https://jackx8x7x.gitbook.io/security-stuff/auth/kerberos#tgs-exchange) in the target computer's domain, *present a TGT*, and ask for a ticket to the computer.

### LSA

Both Active Directory and KDC services are started automatically by the domain controller's [*Local Security Authority*](https://learn.microsoft.com/en-us/windows/win32/secgloss/l-gly) (LSA) and run as part of the LSA's process.

## Account `krbtgt`

The [*security principal*](https://jackx8x7x.gitbook.io/security-stuff/auth/overview#security-principal) name used by the KDC in any domain.

Created automatically when a new domain is created.

### Password

A random password value is assigned to the account automatically by the system during the creation of the domain.

The password for the KDC's account is used to derive a cryptographic key for encrypting and decrypting the TGTs that it issues.

Refer to .

## KDC Related Attacks

* [Golden Ticket Attack](https://jackx8x7x.gitbook.io/security-stuff/windows/credential-access/kerberos-ticket/golden-silver-ticket-attack)
