Editing Kerberos (protocol) (section)

===Microsoft Windows===
[[Windows 2000]] and later versions use Kerberos as their default authentication method.<ref name="MSTN-Kerberos-Auth">{{cite web|url=https://technet.microsoft.com/pt-br/library/cc780469(v=ws.10).aspx|title=What Is Kerberos Authentication?|date=8 October 2009 |publisher=Microsoft TechNet|url-status=live|archive-url=https://web.archive.org/web/20161220084434/https://technet.microsoft.com/pt-br/library/cc780469(v=ws.10).aspx|archive-date=2016-12-20}}</ref> Some [[Microsoft]] additions to the Kerberos suite of protocols are documented in RFC 3244 "Microsoft Windows 2000 Kerberos Change Password and Set Password Protocols". RFC 4757 documents Microsoft's use of the [[RC4]] cipher.  While Microsoft uses and extends the Kerberos protocol, it does not use the MIT software.

Kerberos is used as the preferred authentication method: in general, joining a client to a Windows domain means enabling Kerberos as the default protocol for authentications from that client to services in the Windows domain and all domains with trust relationships to that domain.<ref name="MSTN-Kerberos-Auth"/>

In contrast, when either client or server or both are not joined to a domain (or not part of the same trusted domain environment), Windows will instead use [[NTLM]] for authentication between client and server.<ref name="MSTN-Kerberos-Auth"/>

Internet web applications can enforce Kerberos as an authentication method for domain-joined clients by using APIs provided under [[SSPI]].

Microsoft Windows and Windows Server include {{Mono|setspn}}, a [[command-line interface|command-line]] utility that can be used to read, modify, or delete the Service Principal Names (SPN) for an Active Directory [[service account]].<ref>[https://ss64.com/nt/setspn.html Setspn - Windows CMD - SS64.com]</ref><ref>[https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc731241(v=ws.11) Setspn | Microsoft Docs]</ref>