What is a key reason Kerberos authentication is preferred in AD DS environments?

• A. Kerberos uses tickets for mutual authentication, is faster and more secure than NTLM, and is the default in AD DS
• B. Kerberos relies on password hashes and does not use tickets
• C. Kerberos is deprecated in AD DS
• D. Kerberos only works on Windows 7 clients

Answer: (A)

Kerberos in AD DS relies on a trusted authority (the Key Distribution Center on the domain controller) to issue time-limited tickets that prove the user’s identity to both clients and services. When you log in, you obtain a Ticket Granting Ticket, and from there you request service tickets for specific resources. This system provides mutual authentication: the client verifies the service, and the service verifies the client, without sending the user’s password over the network. Because authentication is done with these tickets and session keys rather than password-based challenges, it is faster and more secure than NTLM and supports seamless single sign-on across the domain. Kerberos is the default authentication method in AD DS, which is why it’s the preferred approach in these environments.