Ticket Granting Ticket (TGT)

The Ticket Granting Ticket is the credential the Key Distribution Center issues when a user first logs on and proves knowledge of their password. From that point the TGT stands in for the password: whenever the user needs to reach a file share, database, or web application, the client presents the TGT to the Ticket Granting Service and receives a service ticket for that specific resource.

The TGT is encrypted with the key of the KRBTGT account, so only the KDC can read or validate it. That design is what makes Kerberos single sign-on work, and it is also the protocol’s most valuable target. An attacker who steals the KRBTGT key can forge TGTs at will, which is exactly the golden ticket attack covered in the golden ticket guide.

Exam relevance: know the sequence cold. Logon produces a TGT, the TGT produces service tickets, and service tickets get you into resources. Questions that describe forging or stealing the logon-stage credential are pointing at the TGT; questions about a single service point at service tickets instead.