The performance of KDC is affected when users request for Ticket Granting Tickets.

If the eDirectory user has grace logins, they are used for Kerberos authentications, and principals are not allowed to change their passwords after the grace logins are exhausted.

Login restrictions are applicable only while the users acquire Ticket Granting Tickets, and are not applicable for subsequent service ticket requests.

The KDC service object is granted Write rights for the ACL attribute on the subtrees of the realm.