Having Domain Controller Certificates on the local computer store of all my domain controllers, and having users using smart card logon , why do i need Strict KDC Validation ? . Can some one give me a senario or risk that will be mitigated by enabling Strict KDC Validation ? ammarhasayen

I got the answer in this post. One of the most amazing posts about certificates and kerberos https://www.isecpartners.com/storage/white-papers/Weaknesses_and_Best_Practices_of_Public_Key_Kerberos_with_Smart_Cards.pdf ammarhasayen