If there is a match, look for a duplicate UPN. If so, then determine if there is a principal with a matching UPN. To resolve this, determine if the requestor has the correct UPN. The difference here is that instead of a missing or duplicate SPN, there is a missing or duplicate User Principal Name (UPN). Similar to KDC_ERR_S_PRINCIPAL_UNKNOWN, KDC_ERR_C_PRINCIPAL_UNKNOWN means the domain controller does not know which client principal it should use to encrypt the ticket. If you would like to see the default Host to SPN mappings use LDP or ADSI Edit and navigate to: cn=Directory Services,CN=Windows NT,CN=Services,CN=Configuration,DC=. The HOST SPN (host/) works for multiple services like HTTP & RPCSS. Determine which principal is appropriate, and remove the SPN from the other(s). In this scenario, the domain controller does not know which principal to use, so it returns the same error. The other major cause for this is the SPN was registered to more than one principal in the same Active Directory domain. In that case, you should identify which principal will be decrypting the ticket, and register the SPN to that account. The first is the SPN is not registered to any principal. There are two major causes of this error. When a domain controller returns KDC_ERR_S_PRINCIPAL_UNKNOWN, it means the client sent a ticket request for a specific Service Principal Name (SPN) and was unable to locate aĪctive Directory object via an LDAP query with that service principal name defined on it. Important: Depending on the application, the topology, and the domain structure, it may be beneficial to take simultaneous network captures from various points including the client, middle-tier server(s), and back-end server(s). Remember to click theīutton again to make the changes effective. If there is a lot of traffic, remove the lines for NLMP to reduce some of the noise. You can do this by clicking theīutton before the filter is actually loaded. If you are using Wireshark, you can filter using the string ‘Kerberos’.įilter that shows packets containing Kerberos tickets as well.

Now that you have the capture, you can filter the traffic using the string ‘Kerberosv5’ if you are using Network Monitor. Reproduce the authentication failure with the application in question Clear system / computer Kerberos tickets using (Vista or higher only):ħ. To reduce the possibility of caching data, do one of the following:Ħ. I typically preferįor captures as it gathers the process name, but you can use either one.ġ. Follow the steps below to see the requests and possible returned failures. If you are looking for Kerberos related problems, it is important to see the ticketing process over the wire. What is the best way to get the network capture? If you are unfamiliar with Kerberos Authentication, I recommend reading I designed this post for IT professionals who have experience reviewing network captures. In this post, I’m going to go over many of the common Kerberos errors seen in these traces, explain what they mean, and what to do about it when you see it. When you review the capture, you may see various Kerberos errors but you may not know what they mean or if they are real problems. When troubleshooting Kerberos authentication issues, a network capture is one of the best pieces of data to collect. First published on TechNet on Jul 27, 2012

T5 handshaker