Ticket Granting Service (TGS)

The Ticket Granting Service is one half of the Key Distribution Center, alongside the Authentication Service. The Authentication Service handles the initial logon and issues the Ticket Granting Ticket; the TGS handles everything after that, exchanging a valid TGT for service tickets whenever the user wants to reach a specific resource.

The detail worth memorising is how the TGS encrypts its output. Each service ticket is encrypted with the password-derived key of the service account that owns the target Service Principal Name. Only that service can decrypt the ticket, which is elegant, but it also means any authenticated user can request a ticket and take it away to crack offline. That is the mechanism behind Kerberoasting, and it is why forged service tickets, the silver ticket attack, never need to touch the TGS at all.

Exam relevance: distinguish the two KDC services. The Authentication Service issues TGTs at logon; the TGS issues service tickets on demand. A question describing “requesting access to a specific server using an existing ticket” is describing the TGS exchange.