KDC
termsecuritynetworking
Key Distribution Center: the Kerberos authority - Authentication Service plus Ticket-Granting Service - that verifies principals and issues the TGT and service tickets; in Active Directory it runs on the domain controllers.
Clients talk to the KDC at login and when first reaching each service; after that, tickets verify offline, which is why KDC placement and time sync matter more than KDC throughput.
The key distribution centre is the Kerberos server that issues tickets, comprising an authentication service that grants the initial ticket and a ticket-granting service that issues service tickets from it. In a Windows domain, every domain controller is one.
Its centrality creates the properties worth knowing. Time synchronization is mandatory because tickets carry timestamps and a skew beyond tolerance rejects them, which is why clock drift presents as an authentication failure. And compromise of the account that encrypts ticket-granting tickets allows an attacker to mint tickets for any identity, valid until that key is rotated twice, which is the attack that makes domain controller compromise so much worse than server compromise.
Also known as: Key Distribution Center