NTSTATUS 0xC000040B (STATUS_CROSSREALM_DELEGATION

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: Kerberos constrained delegation failed because the target lies in another realm.

Previous	Next
STATUS_NO_S4U_PROT_SUPPORT	STATUS_REVOCATION_OFFLINE_KDC

STATUS_CROSSREALM_DELEGATION_FAILURE

The failing second hop is a delegation topology problem, not the user’s initial logon

STATUS_CROSSREALM_DELEGATION_FAILURE belongs to Kerberos constrained delegation. In an S4U2proxy flow, a front-end service obtains a service ticket to a second service on behalf of a user. Microsoft’s Service for User specification describes the TGS request, including the target service name and realm. The NTSTATUS explicitly identifies an unsupported or misconfigured cross-realm target.

Draw the authentication path as client → Service 1 → Service 2 and record the realm/domain and SPN at each hop. A user can authenticate successfully to Service 1 while the delegated request to Service 2 fails. Compare the target SPN with the service account’s allowed-to-delegate configuration and determine whether name canonicalization sends the target into a different realm than administrators intended.

Do not add broad delegation rights simply to cross the realm boundary. Delegation expands where a service can act on behalf of users and must be configured deliberately. Correct an erroneous SPN or realm mapping, or use a delegation model and trust topology that explicitly supports the required target. Preserve KDC TGS events and the S4U2proxy request for the failing second hop.

What to inspect

The front-end service account, Service 1 SPN, target Service 2 SPN, and realm/domain of each service.
Allowed-to-delegate targets or resource-based constrained-delegation configuration for the actual service accounts.
The S4U2proxy TGS request and KDC response, including target realm after canonicalization or referrals.

References

Looking for a different code? Search another status or error code.