HRESULT 0x8009033D (SEC_E_PKINIT_NAME

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

SEC_E_PKINIT_NAME_MISMATCH the client certificate does not contain a valid UPN, or does not match the client name in the logon request. Please contact.

Previous	Next
SEC_E_NO_PA_DATA	SEC_E_SMARTCARD_LOGON_REQUIRED

SEC_E_PKINIT_NAME_MISMATCH

SEC_E_PKINIT_NAME_MISMATCH signals this condition: The certificate UPN is missing, invalid, or does not match the identity in the smart-card logon request. PKINIT uses certificate-based Kerberos authentication. Windows requires the certificate identity and the requested account identity to map consistently; a mismatched UPN is a certificate issuance or account-mapping problem.

What to check

Compare the user principal name in the certificate with the account name used for the logon request.
Verify certificate validity, Smart Card Logon EKU, and the intended domain mapping.
For cross-forest scenarios, review whether a user-name hint is needed instead of changing mappings blindly.

Microsoft: SSPI status codes

Microsoft: Smart-card certificate requirements

Looking for a different code? Search another status or error code.