Windows Server · Windows · high · Active Directory deep faults

Kerberos failures — clock skew, SPN duplicates and KDC errors

Kerberos fails in a small number of specific ways, and each error code names its cause precisely.

What you see

Authentication falls back to NTLM, a service will not start under its account, or users are prompted for credentials repeatedly on internal sites.

What is actually wrong

Clock skew over five minutes, a service principal name registered on more than one account, or an SPN that does not exist for the name being used.

Codes and articles

KRB_AP_ERR_SKEWKDC_ERR_S_PRINCIPAL_UNKNOWNEvent 4771Event 4769duplicate SPNKRB_AP_ERR_MODIFIED

Fixes (2)

Fix the time hierarchy, not just the clock

Elevated PowerShell40 minutesmedium riskreversible

Clock skew errors.

Check the skew from a client against the domain controller.
PowerShell
```
w32tm /stripchart /computer:dc01.example.local /samples:5 /dataonly
```
Check the PDC emulator's configuration — the whole domain follows it and it is the only machine that should look outside.
PowerShell
```
netdom query fsmow32tm /query /configurationw32tm /query /status
```
The domain time hierarchy is PDC emulator to an external source, every other controller to the PDC, every member to a controller. One machine configured differently — usually a controller pointed at time.windows.com — puts the whole domain into a disagreement it cannot resolve.

Set the PDC emulator to a reliable external source.

PowerShell

w32tm /config /manualpeerlist:"time.nist.gov,0x8 ntp2.npl.co.uk,0x8" /syncfromflags:manual /reliable:yes /updateRestart-Service w32timew32tm /resync /rediscover

Set every other machine to follow the domain hierarchy.

PowerShell

w32tm /config /syncfromflags:domhier /updateRestart-Service w32timew32tm /resync

On a virtualised controller, disable host time synchronisation — the host and the domain hierarchy both correcting the clock is a common cause of persistent skew.
PowerShell
```
Get-VMIntegrationService -VMName DC01 -Name 'Time Synchronization' | Format-List VMName,Name,Enabled
```

Confirm it workedEvery machine reports a source consistent with the hierarchy and a small offset.

PowerShell

w32tm /query /status | Select-String 'Source|Last Successful'w32tm /monitor

If you need to undo itw32tm /config /syncfromflags:domhier restores the default behaviour on a member.

Resolve the service principal name

Elevated PowerShell40 minuteshigh riskreversible

Principal unknown, duplicate SPN, or a silent fallback to NTLM.

Look for duplicates across the whole forest. A duplicate breaks Kerberos for both accounts, not just one.
PowerShell
```
setspn -X -F
```
A duplicate SPN means the KDC cannot decide which account to issue a ticket for, so it issues none. This is the cause behind a large share of "Kerberos silently falls back to NTLM" reports.

See what is registered for the account in question.

PowerShell

setspn -L DOMAIN\svc_sqlGet-ADUser svc_sql -Properties ServicePrincipalNames | Select-Object -ExpandProperty ServicePrincipalNames

Remove the wrong registration rather than adding another.
PowerShell
```
setspn -D MSSQLSvc/sql01.example.local:1433 DOMAIN\wrong_account
```
Add it to the correct account, in both the short and fully qualified forms.
PowerShell
```
setspn -S MSSQLSvc/sql01.example.local:1433 DOMAIN\svc_sqlsetspn -S MSSQLSvc/sql01:1433 DOMAIN\svc_sql
```
-S checks for a duplicate before adding, where -A does not. Using -A is how most duplicate SPNs get created in the first place.
Purge the client's ticket cache and test again — an old ticket will keep failing after the fix.
PowerShell
```
klist purgeklist purge -li 0x3e7klist
```

Consider a group managed service account, which registers and rotates its own SPNs.

PowerShell

New-ADServiceAccount -Name gmsa_sql -DNSHostName sql01.example.local -ServicePrincipalNames 'MSSQLSvc/sql01.example.local:1433'

Confirm it workedsetspn -X reports no duplicates and the client receives a Kerberos ticket for the service.

PowerShell

setspn -X -Fklist | Select-String 'Server:'

If you need to undo itsetspn -D and -S can restore the previous registrations, which should be recorded before changing.

Related faults

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.