What does HRESULT 0x80090356 (SEC_E_NO_S4U_PROT_SUPPORT) mean?

SEC_E_NO_S4U_PROT_SUPPORT

SEC_E_NO_S4U_PROT_SUPPORT concerns S4U protocol support on the contacted domain controller. The service requested a Kerberos Service-for-User extension, but the KDC handling the request cannot provide the required S4U behavior.

What the code establishes

Service-for-User is a Kerberos extension evaluated by the KDC, not a local password check in an S4U protocol support on the contacted domain controller investigation. Record whether the request is S4U2self or S4U2proxy, the service account and realm, target SPN, ticket flags, contacted domain controller, and the delegation configuration visible to that controller.

Facts to preserve before changing state

1. 1. S4U stage, service principal, user principal, target SPN, source and target realms
   Identify the domain controller and forest/domain functional environment used for the TGS exchange.
2. 2. KDC or domain controller identity and its supported protocol behavior
   Capture whether the request is S4U2self or S4U2proxy and the service account/SPN involved.
3. 3. Delegation configuration, ticket flags, and the exact failure returned to SSPI
   Check replication, DC selection, and compatibility before changing delegation permissions.

These observations are deliberately nonsecret: identifiers, lengths, provider names, policy selections, and state transitions usually support comparison without recording private keys, passwords, PINs, or plaintext.

Build a timeline before changing state

Authentication failures are multi-leg transactions. Align client SSPI calls, DNS and target-name resolution, policy refresh, domain-controller or KDC events, ticket acquisition, server acceptance, and any proxy or TLS transition. A single application timestamp is not enough to tell whether the decision was local policy, peer identity, context state, or KDC behavior in this condition investigation.

• Package and target name, requested and returned context attributes, and each SSPI return in order.
• Relevant Group Policy result, SPN or UPN resolution, contacted DC/KDC, and ticket or certificate identities.
• One permitted control target and one deliberately rejected target evaluated with the same client build in this condition investigation.

Isolation procedure

Test an in-realm target already allowed for constrained delegation before testing the failing cross-realm or unsupported path. This separates basic service-account configuration from the realm boundary or KDC capability that selected the status.

1. Use one known-good control that changes only the suspected part of this path.
2. Record where behavior first diverges in this path instead of judging only by the final application message.

Common wrong turns

This code concerns protocol support at the KDC; an authorization failure from a capable KDC should be investigated as delegation policy instead. Changing application credentials does not add S4U support to a domain controller and does not extend a constrained-delegation allow-list. Keep protocol capability and account authorization separate.

Proving the intended path works

The intended KDC must issue the required ticket for the configured target and realm while preserving the expected delegation restrictions in this condition investigation.

Technical references

These sources define the HRESULT and the relevant interface, protocol, or data format.

• Microsoft Open Specifications: HRESULT values.
• Microsoft Open Specifications: Kerberos S4U.
• Microsoft Open Specifications: S4U2proxy.
• RFC 4120: The Kerberos Network Authentication Service.