What happens at Kerberos logout, and why does it not invalidate tickets that were already issued?

Question

Accepted Answer

Logout only deletes the client's credential cache (all session keys and tickets); there is no message to the KDC or the services, so a copy of a ticket and its session key taken earlier stays usable until its lifetime runs out.
When the employee logs off from Windows in the evening (or runs kdestroy on Linux), the client software wipes its credential cache. The user's own machine can no longer use the tickets, and the next access needs a new logon.
What logout does not do:

It does not tell the KDC. Kerberos has no revocation list for tickets; a ticket is valid if it decrypts correctly and has not expired.
It does not tell the services. Servers simply discard expired tickets and session keys from their own stores over time.

So the ticket lifetime is the real limit on damage. If an attacker copied the TGT and its session key from memory before logout, they can keep requesting service tickets until the TGT expires. This is why lifetimes are kept to hours, why disabling a user account in the directory matters (the KDC refuses new tickets for disabled accounts), and why credential caches need strong protection.
Go deeper:

MIT Kerberos documentation: kdestroy — the logout command that destroys the credential cache.