Otherwise, the remote KDC will respond to a client with this error code. Since the remote KDC may change its PKCROSS key while there are PKCROSS tickets still active, it should cache the old PKCROSS keys until the last issued PKCROSS ticket expires. There may be explicit restrictions on the account the account could also be disabled, expired, or locked out.

This error code can't occur in event 4768, but it can occur in 4771.

The DC doesn’t have a certificate installed for smart cards (Domain Controller or Domain Controller Authentication templates).

This can happen because the wrong certificate authority (CA) is being queried or the proper CA can't be contacted.

Smart card logon is being attempted and the proper certificate can't be located.

KDC has no support for PADATA type (pre-authentication data) The KDC, server, or client received a packet that it doesn’t have an appropriate encryption key for, so it can't decrypt the ticket. The KDC or client received a packet that it can't decrypt.

The client is attempting to delegate credentials to a SPN that's not in its Allowed-to-delegate-to list.

There are logon restrictions on the user’s account, like a workstation restriction, smart card authentication requirement, or logon time restriction. There is a time difference between the KDC and the client. Requested start time is later than the end time This usually means that the administrator should reset the password on the account.Ī client has requested postdating of a Kerberos ticket (setting the ticket’s start time to a future date/time), or there is a time difference between the client and the KDC. No master key was found for the client or server. The client or server has a null key (master key) Without unique principal names, the client has no way of ensuring that the server it's communicating with is the correct one. Unique principal names are crucial for ensuring mutual authentication duplicate principal names are strictly forbidden, even across multiple realms. Multiple principal entries in KDC database The DC can't find the server’s name in Active Directory.

Requested Kerberos version number not supported Server's entry in KDC database has expired The result codes are listed in the following table: CodeĬlient's entry in KDC database has expired Result Code: This is a set of different failure codes displayed in hexadecimal format. Ticket Options: A set of different ticket flags in hexadecimal format.Ġx40810010 - Forwardable, Renewable, Canonicalize, Renewable-okĠx40810000 - Forwardable, Renewable, CanonicalizeĠ圆0810010 - Forwardable, Forwarded, Renewable, Canonicalize, Renewable-ok

Program rejected invalid policy sccm