When users sign in to an Active Directory Domain Services (AD DS) domain, they provide their user credentials to a domain controller. As a result of successful authentication, the authenticating domain controller issues Kerberos tickets to the user’s computer. The user’s computer uses these tickets to establish sessions with servers that are part of the same AD DS forest. When a server receives a session request, it examines the Kerberos ticket for validity. If the ticket is valid in all respects and is issued by a trusted authenticating authority, such as a domain controller in the same AD DS forest, the session is allowed.