| Previous | Next |
| STATUS_PKINIT_FAILURE | STATUS_NO_KERB_KEY |
STATUS_SMARTCARD_SUBSYSTEM_FAILURE
The smart-card subsystem failed during Kerberos logon
This status means the Kerberos path reached smart-card processing and then failed in the local smart-card subsystem. The KDC and certificate can be correctly configured, while the client cannot complete card access, PIN interaction, provider loading, or private-key use.
Separate local card evidence from domain evidence. A failure before a valid PKINIT request reaches the KDC should be debugged with smart-card service, minidriver, CSP/KSP, reader and certificate-enumeration information.
What to inspect
- Check reader presence, card minidriver/CSP/KSP, and Smart Card service state.
- Confirm that the certificate is visible to Windows logon and has a usable private key.
- Compare local smart-card logs with domain-controller KDC events.
References
- Microsoft: Smart card certificate requirements and enumeration
- Microsoft: Enabling smart card logon with third-party CAs
- Microsoft Open Specifications: MS-PKCA
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.