What is a service ticket, what does it contain, and who can read it?

A service ticket is issued by the TGS for one specific service; it contains the user ID, the service ID, a timestamp, its lifetime (several hours) and the service session key, and it is encrypted with that service's secret key, so only the service (and the KDC) can read it.

Contents:

• User ID and optionally network addresses
• Service ID (the service principal, for example HTTP/crm.acme.com)
• Timestamp and lifetime (around 8 to 10 hours in typical configurations)
• Service session key

The service ticket is to the service what the TGT is to the TGS: a sealed note the client carries but cannot read. When the service decrypts it with its own key, it learns who the user is and which session key to expect, without having to ask the KDC. One service ticket is valid for one service only; for a second service the client asks the TGS for a second ticket.

Go deeper:

• Microsoft Learn: Maximum lifetime for service ticket — the default service-ticket lifetime (600 minutes) in a Windows domain.
• RFC 4120, Section 5.3: Tickets — the ticket structure shared by TGTs and service tickets.