Kerberos error on 2 Windows 2008 R2 Enterprise 64-bit servers with MS Clustered
- I have a 2 Windows 2008 R2 Enterprise 64-bit servers setup with MS Clustered and in the Windows System Event viewer I am getting a Kerberos error as follows -- how do I fix this?:
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server host/DC name. The target name used was HOST/DC name. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Please ensure that the target SPN is registered on, and only registered on, the account used by the server. This error can also happen when the target service is using a different password for the target service account than what the Kerberos Key Distribution Center (KDC) has for the target service account. Please ensure that the service on the server and the KDC are both updated to use the current password. If the server name is not fully qualified, and the target domain (Domain name) is different from the client domain (Domain name), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.
Answers
- can you run a setspn -L <accountname>. And setspn -X as well ?
ThorstenWujek- Marked As Answer byMervyn ZhangMSFT, ModeratorTuesday, November 03, 2009 7:56 AM
All Replies
- Hi,
can you please provide the hole event (source,ID). It is important to find out what account is meant. Can you please describe your infrastructure more detailed ?
Bye
ThorstenWujek - Source is Security-Kerberos
Event ID 4
We have a mixed environment of 24 Windows 2003 and Windows 2008 R2 domain controllers nationwide. The domain controller referenced in the post above is located in the same building as the Windows 2008 R2 server that is getting this error msg. That domain controller is a Windows 2003 server. The "DC name" that is stated in previous post is not the actual name but stated as "DC name" for security reasons. The same for "(domain name)". - can you run a setspn -L <accountname>. And setspn -X as well ?
ThorstenWujek- Marked As Answer byMervyn ZhangMSFT, ModeratorTuesday, November 03, 2009 7:56 AM
- and as well klist tickets on the node where the error is occuring
ThorstenWujek
