> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/active-directory-abuse-kerberos-delegation-and-ad-cs/glossary.md).

# Glossary

### Terms

| Term                 | Definition                                                                                                                               |
| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| AD CS                | Active Directory Certificate Services. Microsoft's PKI platform for issuing and managing certificates.                                   |
| CA                   | Certificate Authority. The service that signs and issues certificates.                                                                   |
| Certificate template | A reusable set of issuance rules that defines who can enroll and what the certificate can contain.                                       |
| CSR                  | Certificate Signing Request. A request that carries the public key and desired identity information.                                     |
| EKU                  | Extended Key Usage. An object identifier that defines what a certificate can be used for.                                                |
| Enterprise CA        | A CA integrated with Active Directory that supports domain-aware templates and enrollment.                                               |
| KDC                  | Key Distribution Center. The Kerberos service on a domain controller that issues TGTs and TGSs.                                          |
| PAC                  | Privilege Attribute Certificate. The privilege and identity data carried inside a Kerberos ticket.                                       |
| PKI                  | Public Key Infrastructure. The systems and policies used to manage certificates and trust.                                               |
| RBCD                 | Resource-Based Constrained Delegation. A delegation model where the target resource defines which principals may act on behalf of users. |
| SAN                  | Subject Alternative Name. An extension that can carry additional identities such as UPNs or DNS names.                                   |
| Schannel             | Secure Channel. The Windows TLS stack often used for certificate-backed LDAP authentication.                                             |
| S4U2Proxy            | Service for User to Proxy. A Kerberos extension used to request a service ticket to another service on behalf of a user.                 |
| S4U2Self             | Service for User to Self. A Kerberos extension used to request a ticket to the current service on behalf of a user.                      |
| SPN                  | Service Principal Name. The identifier that maps a service instance to the account that owns it.                                         |
| TGS                  | Ticket Granting Service ticket. The Kerberos ticket presented to a target service.                                                       |
| TGT                  | Ticket Granting Ticket. The Kerberos ticket used to request service tickets from the KDC.                                                |
| UPN                  | User Principal Name. A logon-style identifier such as `user@domain.local`.                                                               |
| LSASS                | Local Security Authority Subsystem Service. The Windows process that handles logon state, secrets, and access token creation.            |