| Previous | Next |
| STATUS_HOST_DOWN | STATUS_EFS_ALG_BLOB_TOO_BIG |
STATUS_UNSUPPORTED_PREAUTH
The Kerberos pre-authentication type is unsupported
Kerberos pre-authentication adds proof to the initial AS exchange before a ticket-granting ticket is issued. PKINIT is one such extension, but Windows deployments can also negotiate other encrypted timestamp and extension data.
This status points to a mechanism mismatch. The relevant data is the pre-authentication type advertised or selected, the account and domain policy, and the KDC/client versions, not simply whether the password is correct.
What to inspect
- Look at KDC event 4771 and the pre-authentication type or failure code.
- Check whether the account requires smart-card or other special pre-authentication.
- Verify client, KDC, and domain functional-level support for the mechanism.
References
- Microsoft Open Specifications: MS-KILE Kerberos extensions
- RFC 4120: Kerberos V5
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: Event 4771 Kerberos pre-authentication failed
Looking for a different code? Search another status or error code.