Definition
A Key Distribution Center (KDC) issues Kerberos tickets used for authentication within a realm or directory domain.
How it works
It provides the Authentication Service and Ticket Granting Service. Clients obtain a TGT and then request a service ticket for a specific SPN; Active Directory domain controllers host KDC services.
Real-world example
When a user opens an SMB share, the workstation obtains a ticket for that service without repeatedly sending the user password to the file server.
Limits and best practices
Check clock synchronization, SPNs, DNS and domain-controller availability. Restrict delegation and investigate Kerberos failures.