COMMAND EVERYTHING.

Set-ADAuthenticationPolicy

Modifies an Active Directory Domain Services authentication policy object.

Last verified: 2026-10-26

Microsoft ActiveDirectory reference: Modifies an Active Directory Domain Services authentication policy object. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.

Set-ADAuthenticationPolicy [-WhatIf] [-Confirm] [-Add <Hashtable>] [-AuthType <ADAuthType>] [-Clear <String[]>]
 [-ComputerAllowedToAuthenticateTo <String>] [-ComputerTGTLifetimeMins <Int32>] [-Credential <PSCredential>]
 [-Description <String>] [-Enforce <Boolean>] [-Identity] <ADAuthenticationPolicy> [-PassThru]
 [-ProtectedFromAccidentalDeletion <Boolean>] [-Remove <Hashtable>] [-Replace <Hashtable>]
 [-RollingNTLMSecret <ADStrongNTLMPolicyType>] [-Server <String>] [-ServiceAllowedToAuthenticateFrom <String>]
 [-ServiceAllowedToAuthenticateTo <String>] [-ServiceAllowedNTLMNetworkAuthentication <Boolean>]
 [-ServiceTGTLifetimeMins <Int32>] [-UserAllowedToAuthenticateFrom <String>]
 [-UserAllowedToAuthenticateTo <String>] [-UserAllowedNTLMNetworkAuthentication <Boolean>]
 [-UserTGTLifetimeMins <Int32>] [<CommonParameters>]

Required permissions

Use an account with the target resource permissions documented for Set-ADAuthenticationPolicy. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.

Supported environments

Windows / ActiveDirectory · Windows Server 2025 documentation; feature/module prerequisites apply

Parameters

-Add

Specifies a list of values to add to an object property. Use this parameter to add one or more values to a property that cannot be modified using a parameter. To identify an attribute, specify the Lightweight Directory Access Protocol (LDAP) display name defined for it in the Active Directory Domain Services schema. Specify the attribute and the value of the attribute in the following format: @{'AttributeLDAPDisplayName'=value}. To specify multiple values for an attribute, specify a comma separated list the values for the display name. You can specify values for more than one attribute by using semicolons to separate attribute value pairs. When specifying the *Add*, *Remove*, *Replace*, and *Clear* parameters together, the operations are performed in the following order: - Remove - Add - Replace - Clear

-AuthType

Specifies the authentication method to use. The acceptable values for this parameter are: - Negotiate or 0 - Basic or 1 The default authentication method is Negotiate. A Secure Sockets Layer (SSL) connection is required for the Basic authentication method.

-Clear

Specifies an array of object properties that are cleared in the directory. Use this parameter to clear one or more values of a property that cannot be modified using a parameter. To modify an object property, you must specify the LDAP display name. You can modify more than one property by specifying a comma-separated list. When specifying the *Add*, *Remove*, *Replace*, and *Clear* parameters together, the operations are performed in the following order: - Remove - Add - Replace - Clear

-ComputerAllowedToAuthenticateTo

Specifies the security descriptor definition language (SDDL) string of the security descriptor used to determine if the computer can authenticate to this account.

-ComputerTGTLifetimeMins

Specifies the lifetime in minutes for non-renewable ticket granting tickets (TGTs) for computer accounts.

-Confirm

Prompts you for confirmation before running the cmdlet.

-Credential

Specifies a user account that has permission to perform the task. The default is the current user. Type a user name, such as "User01" or "Domain01\User01", or enter a PSCredential object, such as one generated by the Get-Credential cmdlet. By default, the cmdlet uses the credentials of the currently logged on user unless the cmdlet is run from an Active Directory Domain Services Windows PowerShell provider drive. If you run the cmdlet in a provider drive, the account associated with the drive is the default. If you specify credentials that do not have permission to perform the task, the cmdlet returns an error.

-Description

Prerequisites

Windows with the ActiveDirectory module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.

Security considerations

This cmdlet changes system state. Review every target and parameter in the official reference, test outside production, and prepare an appropriate backup or rollback. Do not execute the example automatically.

Examples

Set-ADAuthenticationPolicy -Identity AuthenticationPolicy01 -Description "TestDescription" -UserTGTLifetimeMins 45

Sources

https://github.com/MicrosoftDocs/windows-powershell-docs/blob/b7645dd8c687139b28e845119da30ec670526507/docset/winserver2025-ps/ActiveDirectory/Set-ADAuthenticationPolicy.md

https://learn.microsoft.com/powershell/module/activedirectory/set-adauthenticationpolicy?view=windowsserver2025-ps

Explain or customize this command with AI

Related commands

Get-ADComputer

Get-ADGroup

Get-ADGroupMember

Get-ADPrincipalGroupMembership