Kerberos Error Codes

17rows

17rows with meaning

1lookups that use it

Livestatus

The result codes a Kerberos key distribution center returns when a ticket request fails. They carry the detail behind a domain sign-in failure: a wrong password, an expired ticket, clocks that drifted apart.

This table decodes 17 codes.

SparkLogs decodes these codes on every event that carries one, regardless of feed. The Windows Security event log feed reads these codes while curating an event.

How to read this

Codes are listed in numeric order. Name is the constant Windows publishes for the code. Token is the short label SparkLogs puts on the event, which is what a question groups by. The last column is our one-line summary of what the code means in plain words.

Codes 0x6 to 0x3c

Code	Name	Token	What it means
0x6	KDC_ERR_C_PRINCIPAL_UNKNOWN	client_unknown	the client principal is not in the directory
0x7	KDC_ERR_S_PRINCIPAL_UNKNOWN	service_unknown	the service principal is not in the directory
0x8	KDC_ERR_PRINCIPAL_NOT_UNIQUE	principal_not_unique	more than one entry matches the principal name
0x9	KDC_ERR_NULL_KEY	null_key	the principal has no usable key
0xc	KDC_ERR_POLICY	policy_restriction	KDC policy rejected the request
0xd	KDC_ERR_BADOPTION	bad_option	the request carried an option the KDC refused
0xe	KDC_ERR_ETYPE_NOSUPP	etype_unsupported	no encryption type in common with the KDC
0x10	KDC_ERR_PADATA_TYPE_NOSUPP	preauth_type_unsupported	the offered preauthentication type is not supported
0x12	KDC_ERR_CLIENT_REVOKED	client_revoked	the client account is disabled expired or locked out
0x17	KDC_ERR_KEY_EXPIRED	key_expired	the account password has expired
0x18	KDC_ERR_PREAUTH_FAILED	preauth_failed	preauthentication failed usually a wrong password
0x1f	KRB_AP_ERR_BAD_INTEGRITY	integrity_check_failed	message integrity check failed
0x20	KRB_AP_ERR_TKT_EXPIRED	ticket_expired	the presented ticket has expired
0x22	KRB_AP_ERR_REPEAT	replay_detected	the request repeats one the KDC already served
0x25	KRB_AP_ERR_SKEW	clock_skew	client and KDC clocks differ too much
0x29	KRB_AP_ERR_MODIFIED	message_modified	the message was altered in transit
0x3c	KRB_ERR_GENERIC	generic_error	the KDC reported a generic failure

Ask about these codes

Connect your AI and ask in plain language, or open the same events in Explore.