A ticket-granting ticket is the Kerberos credential a client receives after proving its identity to the Key Distribution Center (KDC). The TGT is not used to access a file, database, or app directly. Instead, it is presented back to the KDC to request service tickets for specific services.
This matters because the TGT sits at the center of Kerberos trust. If an attacker steals, forges, or reuses a TGT, they may impersonate a user and request access across the domain without repeatedly entering a password. That is why TGT abuse is often linked to Golden Ticket attacks and other identity-theft techniques. Defenders watch for unusual ticket lifetimes, abnormal encryption types, and suspicious ticket-request patterns on domain controllers. Protecting the KDC, the KRBTGT secret, and authentication logs helps limit the impact of TGT compromise.