What does NTSTATUS 0xC00002F4 (STATUS_MAX_REFERRALS_EXCEEDED) mean?

 
Previous Next
STATUS_CRYPTO_SYSTEM_INVALID STATUS_MUST_BE_KDC

STATUS_MAX_REFERRALS_EXCEEDED

A referral chain is looping or unexpectedly long; the KDC may still be generating referrals successfully

STATUS_MAX_REFERRALS_EXCEEDED is a client-side guard on Kerberos referral processing. Cross-realm referrals let a KDC direct a client toward another realm when the target service is not in the current realm. RFC 6806 specifies principal canonicalization and cross-realm referral behavior, while Windows KILE adds Microsoft implementation rules.

This status differs from STATUS_KDC_UNABLE_TO_REFER. In that case a KDC cannot construct the required referral. Here the client has already processed too many referrals. Preserve the complete sequence of realms, KDCs, referral TGTs and requested service principal; a repeated realm or alternating pair immediately points to a routing or name-canonicalization loop.

Do not simply raise an implementation limit unless the trust and realm path has been validated. Check the target SPN, DNS-derived name, trust topology, realm mapping and name-suffix routing. A typo or canonicalization change can send the client down a referral path that is valid at each individual hop but never reaches the intended service.

What to inspect

  • The ordered referral chain, including each source realm, referred realm, KDC and ticket-granting service principal.
  • The original target SPN and any canonicalized host or principal names observed during the sequence.
  • Trust and name-suffix routing changes that coincide with the first appearance of the referral loop.

References

Looking for a different code? Search another status or error code.