Hyper-V authentication persistence after domain password expiration
0 reputation · 14 Nov 2022, 06:59 UTC
Hyper-V relies on underlying Windows domain credentials for severalion access, live migration, and remote management. When a user's domain password expires, the behavior of existing and new connection sessions appears inconsistent depending on the authentication protocol utilized during the initial handshake.
If a Kerberos ticket is already cached, it may remain valid until its expiration (typically 7 days), potentially allowing access to resources even after the password has been changed. However, NTLM-based connections do not utilize these tickets, which can result in immediate authentication failures that are not clearly communicated as expiration issues.
How does Hyper-V handle the conflict between a valid Kerberos ticket and an expired domain password for active combination management sessions? Is there a specific configuration to force Hyper-V to Validate the current status of domain credentials regardless of existing session token validity?