# This is an example of krb5.conf for authentication with Active Directory
# Tested on libkrb5-3 1.15-1+deb9u1

[libdefaults]
default_realm = EXAMPLE.COM
dns_lookup_realm = true
dns_lookup_kdc = true
forwardable = true

# Values for next three parameters should be used from Default Domain Policy GPO
# Default Domain Policy \ Computer Configuration \ Policies \ Windows Settings \ ...
# ... \ Security Settings Account Policies \ Kerberos Policy
# Maximum lifetime for user ticket
ticket_lifetime = 10h
# Maximum lifetime for user ticket renewal
renew_lifetime = 7d
# Maximum tolerance for computer clock synchronization
clockskew = 300

[realms]
EXAMPLE.COM = {
    admin_server = dc01.example.com
    kdc = dc01.example.com
    kdc = dc02.example.com
    kdc = dc03.example.com
    kdc = dc04.example.com
    kdc = dc05.example.com
}