How to Use the klist Command in Windows 11 to Inspect, Purge, and Troubleshoot Kerberos Tickets

In enterprise Active Directory environments, Microsoft Windows 11 relies on the Kerberos Version 5 protocol as its primary authentication mechanism for accessing domain resources, shared file shares (SMB), internal web portals (IIS with Integrated Windows Authentication), and SQL Server databases. When a user authenticates against a Domain Controller (DC), the Key Distribution Center (KDC) issues a Ticket-Granting Ticket (TGT). Subsequent access requests to network services prompt the client to request Service Tickets (STs) associated with specific Service Principal Names (SPNs).

However, when access permissions change, group memberships update in Active Directory, or an SPN is misconfigured, stale cached Kerberos tickets can block access with authentication errors (such as Access Denied or KDC_ERR_S_PRINCIPAL_UNKNOWN). Rather than requiring a full user logoff or workstation reboot, Windows administrators and power users can manage, inspect, and purge the local Kerberos ticket cache directly from the command line using klist. This technical guide explains Kerberos ticket architectures, how to use klist to inspect cached tickets, how to purge stale credentials, and how to troubleshoot Kerberos authentication failures in Windows 11.

Anatomy of Kerberos Tickets in Windows 11

Kerberos ticket operations revolve around two primary ticket types cached in local memory (LSA subsystem):

Ticket Category	Issuer	Operational Role	Default Lifetime
Ticket-Granting Ticket (TGT)	KDC Authentication Service (AS)	Proves the client’s identity to the KDC. Used to request Service Tickets without repeatedly transmitting the user’s password hash.	10 hours (renewable up to 7 days).
Service Ticket (ST / TGS)	KDC Ticket-Granting Service (TGS)	Grants access to a specific network service identified by its unique Service Principal Name (SPN).	10 hours (co-terminates with TGT).
Client Token (PAC)	KDC Injection Engine	Privilege Attribute Certificate embedded inside tickets containing user security identifiers (SIDs) and group memberships.	Immutable for the lifespan of the ticket.

Querying and Inspecting Active Kerberos Tickets

Open Windows Terminal (PowerShell or Command Prompt) to inspect your active logon session’s Kerberos cache:

# Enumerate all cached Kerberos tickets for the current user session
klist

# Display tickets along with detailed encryption types and ticket flags
klist -lh 0 -li 0x3e7

The standard klist output details cached tickets sequentially:

Current LogonId is 0:0x1b4f2c
Cached Tickets: (2)

#0>     Client: jdoe @ CORP.DIGITASH.COM
        Server: krbtgt/CORP.DIGITASH.COM @ CORP.DIGITASH.COM
        KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
        Ticket Flags 0x40e10000 -> forwardable renewable initial pre_authent name_canonicalize 
        Start Time: 23/10/2026 08:00:12 (local)
        End Time:   23/10/2026 18:00:12 (local)
        Renew Time: 30/10/2026 08:00:12 (local)
        Session Key Type: AES-256-CTS-HMAC-SHA1-96
        Cache Flags: 0x1 -> PRIMARY 
        Kdc Called: DC01.corp.digitash.com

#1>     Client: jdoe @ CORP.DIGITASH.COM
        Server: cifs/fileserver01.corp.digitash.com @ CORP.DIGITASH.COM
        KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
        Ticket Flags 0x40a10000 -> forwardable renewable pre_authent name_canonicalize 
        Start Time: 23/10/2026 08:15:30 (local)
        End Time:   23/10/2026 18:00:12 (local)
        Renew Time: 30/10/2026 08:00:12 (local)
        Session Key Type: AES-256-CTS-HMAC-SHA1-96
        Cache Flags: 0 
        Kdc Called: DC01.corp.digitash.com

Key Information Extracted from klist Inspection

When auditing tickets, pay close attention to the following parameters:

• Server SPN: Verifies the service being targeted (e.g., cifs/ for SMB file shares, http/ for intranet web apps).
• Encryption Type: Identifies cryptographic strength. Enterprise security policies mandate AES-256-CTS-HMAC-SHA1-96; presence of RC4-HMAC indicates deprecated, vulnerable encryption algorithms.
• Kdc Called: Indicates the exact Domain Controller that authenticated the session, vital for troubleshooting replication latency.
• End Time: Identifies ticket expiration, helping isolate expired token rejections.

Purging Stale Tickets to Force Re-Authentication

When an administrator adds a user to a new Active Directory security group, the user’s local Privilege Attribute Certificate (PAC) remains outdated until a new ticket is minted. Rather than restarting the computer, execute a targeted ticket purge:

# Purge all cached tickets for the current logon session
klist purge

The console will output:

Targeting LSA...
    Submitting query to LSA...
    Tickets purged!

Immediately after purging, the very next attempt to connect to a network share or intranet site forces Windows to contact the KDC, minting a fresh TGT and Service Ticket with updated group memberships.

Querying System and LocalSystem Logon Sessions

Scheduled tasks, background Windows services, and IIS application pools run under administrative service accounts or NT AUTHORITY\SYSTEM. To inspect service tickets belonging to other sessions, run an elevated prompt:

# List all active logon sessions on the Windows 11 host
klist sessions

# Query tickets belonging to the LocalSystem account (LogonId 0x3e7)
klist -li 0x3e7

# Purge tickets specifically for the LocalSystem context
klist purge -li 0x3e7

Troubleshooting Common Kerberos Authentication Failures

Error Condition	Underlying Cause	Remediation Step via klist
User added to security group cannot access shared folder	Stale Service Ticket cached with pre-modification PAC SIDs.	Execute klist purge and re-attempt accessing the network share.
Fallback to NTLM authentication	Target server SPN missing, duplicated, or unregistered in Active Directory.	Run klist to check if ticket exists for cifs/hostname; inspect SPN registrations on domain controller via setspn -Q.
KRB_AP_ERR_SKEW (Clock skew too great)	Client workstation and Domain Controller clocks differ by more than 5 minutes.	Run w32tm /resync /force to realign system time before re-requesting tickets.
KRB_AP_ERR_MODIFIED (Encryption key mismatch)	Target service account password was changed while ticket was cached.	Execute klist purge to wipe the obsolete encryption key and request a new ticket.

Mastering klist provides Windows 11 administrators with surgical control over Kerberos authentication caches, enabling instant credential refresh and rapid diagnostics without disruptive workstation restarts.