For a domain under Linux, Kerberos tickets are commonly stored as ccache.

Another file type is keytable file. A keytabl is a file containing pairs of Kerberos principals and encrypted keys (derived from Krb password).

realm - Check if Linux machine is domain-joined

realm list

Check if Linux machine is domain-joined:

ps -ef | grep -i "winbind\\|sssd"

Finding KeyTab files

Commonly, keytab have .keytab extensions, but this is not mandatory.

find / -name *keytab* -ls 2>/dev/null

They also might be in cron jobs, tmp