Your network contains an Active Directory Domain Services (AD DS) domain. You need to configure a ticket-granting ticket (TGT) lifetime for specific user and computer accounts. The solution must meet

A dynamic access control policy is used for authorization decisions based on object properties, not for configuring Kerberos TGT lifetimes.

A password policy dictates password complexity, length, and history requirements, but it does not control Kerberos TGT lifetimes.

Authentication policies in Active Directory Domain Services allow administrators to define specific Kerberos Ticket-Granting Ticket (TGT) lifetimes and apply these settings to a targeted set of security principals. By assigning specific user and computer accounts to an authentication policy silo, the associated authentication policy's TGT lifetime settings are applied only to those accounts, minimizing impact on others and streamlining management.

A fine-grained password policy is used to apply different password and account lockout policies to different user groups, not for configuring Kerberos TGT lifetimes.