Default validity: 10 years - Survives password resets (except krbtgt password reset) - Works even if the impersonated user does not exist - Can include any group SIDs (Domain Admins, Enterprise Admins, etc.)