Kerberos authentication fails when credentials need to be passed between multiple servers (double-hop scenario).
Fix A:
Enable Kerberos delegation for the service account in Active Directory.
How to do it
Open ADUC > Locate the service account > Properties > Delegation tab.
Select Trust this user for delegation to specified services only.
Add the necessary services.
Fix B:
Use constrained delegation if you’re security conscious.
How to do it
On the Delegation tab, choose Use Kerberos only and specify the allowed services.
5. Kerberos overload
Error Message: There isn't a specific Kerberos error message for the Key Distribution Center (KDC) overload; however, symptoms include slow authentication responses or failures.
Issue
The KDC is overloaded with authentication requests.
Fix A:
Load balance your KDCs by ensuring all DCs are functional and accessible.
How to do it
Ensure all domain controllers are functional using: "dcdiag /v".
Check KDC SRV records in DNS: "nslookup -type=SRV _kerberos._tcp.<domain>".
Fix B:
Reduce authentication retries with proper client configurations.
How to do it
Review client configuration: Open Group Policy Editor.
Navigate to: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options.
Adjust Number of retries before locking account.
6. RC4 encryption still hanging around
Error Message: KRB_AP_ERR_BAD_INTEGRITY – "Integrity check on decrypted field failed."
Issue
Kerberos is trying to use outdated RC4 encryption.
Fix A:
Check and update the encryption types in the GPO:
How to do it
Check and update encryption types
Open Group Policy Editor.
Navigate to: Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Kerberos Policy.
