Destroying a Principal's Tickets
Use the kdestroy command to invalidate the tickets that a principal has acquired. When the principal logs out, the principal's tickets are not destroyed; they remain valid until they expire. DCE users may want to use kdestroy just before they log out to ensure that no valid tickets remain. However, if the principal has the kernel-resident ticket cache, the principal's tickets are destroyed when the principal's last process terminates. This means that it is generally not necessary to run kdestroy at logout.
The kdestroy command is described on the kdestroy(8sec) reference page.