Skip to main content

Agentic SOC Alliance Expands as Enterprises Prioritize Autonomous Security

Search
  • Solutionschevron right
  • Industrieschevron right
  • Platformchevron right
  • Resourceschevron right
  • Customerschevron right
  • Partnerschevron right

DETECTION OVERVIEW

Delayed Kerberos Authtentication

Category

Authorization & Access Control
Detection diagram
Next in Authorization & Access Control: Delayed Kerberos Data Transfer

Description

An application on the network had an unusual degradation in Kerberos server performance, which indicates that authentication services might be slow.

Background

Kerberos is a security protocol that applies mutual, secret-key cryptography to client and server authentication, and requires that both the user and server prove their identities. A spike in Kerberos server processing time indicates resource exhaustion. This issue might be related to an overloaded domain controller due to a high volume of authentication requests.

Mitigation Options

Check the Kerberos Key Distribution Center (KDC) for high CPU or memory usage that could delay ticket granting.

Ensure the Active Directory database (NTDS.dit) is properly defragmented to provide low latency storage.

Verify that there are no resource bottlenecks in the network path to the Kerberos server.

Associated content

Announcing The Forrester Wave™: Network Analysis And Visibility Solutions, Q4 2025

Network analysis and visibility solutions remain underrepresented in enterprises. Find out why in this preview of a new Wave report.

Report

ExtraHop® Named a Leader in First-Ever Gartner® Magic Quadrant™ for Network Detection and Response — ExtraHop

ExtraHop® Named a Leader in First-Ever Gartner® Magic Quadrant™ for Network Detection and Response

News

Detections

Visit this resource for more information.

Documentation
Periodic Table of Use Cases

What else can RevealX do for you?