| Previous | Next |
| STATUS_LOST_MODE_LOGON_RESTRICTION | STATUS_SMARTCARD_SUBSYSTEM_FAILURE |
STATUS_PKINIT_FAILURE
PKINIT certificate validation failed during Kerberos logon
PKINIT is the Kerberos public-key preauthentication path used for smart-card and certificate-based logon. This status points to certificate validation in that Kerberos path, not to an ordinary password preauthentication failure.
The domain controller certificate, chain trust, EKU, revocation status, NTAuth store, and client certificate mapping can all be relevant depending on the accompanying KDC event.
What to inspect
- Review KDC and client Kerberos events, especially certificate and revocation details.
- Verify the domain-controller certificate chain, template, EKU, expiration, and NTAuth trust.
- Compare with STATUS_SMARTCARD_SUBSYSTEM_FAILURE when the local smart-card provider fails before Kerberos validation completes.
References
- Microsoft: Kerberos authentication troubleshooting guidance
- Microsoft: Event 4771 Kerberos pre-authentication failed
- Microsoft: Certificate-based Kerberos authentication protections
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.