TGT

A TGT is the credential Kerberos issues after initial login, which the client then presents to obtain tickets for individual services without re-entering a password. It is encrypted with a key derived from the KDC's krbtgt account. Forging TGTs with a stolen krbtgt hash is the infamous Golden Ticket attack, which grants domain-wide access.