klist

Displays a list of currently cached Kerberos tickets. IMPORTANT: You must be at least a Domain Admin, or equivalent, to run all the parameters of this command.

klist [-lh <logonID.highpart>] [-li <logonID.lowpart>] tickets | tgt | purge | sessions | kcd_cache | get | add_bind | query_bind | purge_bind

klist

klist -li 0x3e7

klist tgt

klist purge

klist purge -li 0x3e7

klist sessions

klist kcd_cache

klist get host/%computername%

klist add_bind CONTOSO KDC.CONTOSO.COM

klist add_bind CONTOSO.COM KDC.CONTOSO.COM

klist query_bind

Show 13 options

\-lhDenotes the high part of the user's locally unique identifier (LUID), expressed in hexadecimal. If neither -lh nor -li are present, the command defaults to the LUID of the user who is currently signed in.

\-liDenotes the low part of the user's locally unique identifier (LUID), expressed in hexadecimal. If neither -lh nor -li are present, the command defaults to the LUID of the user who is currently signed in.

ticketsLists the currently cached ticket-granting-tickets (TGTs), and service tickets of the specified logon session. This is the default option.

tgtDisplays the initial Kerberos TGT.

purgeAllows you to delete all the tickets of the specified logon session.

sessionsDisplays a list of logon sessions on this computer.

kcd\_cacheDisplays the Kerberos constrained delegation cache information.

getAllows you to request a ticket to the target computer specified by the service principal name (SPN).

add\_bindAllows you to specify a preferred domain controller for Kerberos authentication.

query\_bindDisplays a list of cached preferred domain controllers for each domain that Kerberos has contacted.

purge\_bindRemoves the cached preferred domain controllers for the domains specified.

kdcoptionsDisplays the Key Distribution Center (KDC) options specified in RFC 4120.

/?Displays Help for this command.