Ahh well if you only compromised passwords then it depends on the domain policy. Often something like 90 or 180 days, but sometimes also only 1 month. But the t

Ahh well if you only compromised passwords then it depends on the domain policy. Often something like 90 or 180 days, but sometimes also only 1 month. But the ticket is different. An attacker can sign and create their own ticket and determine how long it is valid. Obviously an attacker is going for the maximum time which I think is indefinitely for golden tickets (can't quite recall now). Also it's hard to remove the trust in such a ticket once it's been created, it user to be so bad that the entire Forest (with all domains had to be rebuilt) but afaik it's easier(but not trivial) now.