| Previous | Next |
| STATUS_ISSUING_CA_UNTRUSTED_KDC | STATUS_KDC_CERT_REVOKED |
STATUS_KDC_CERT_EXPIRED
The KDC certificate is outside its validity period
This status is specific to certificate-based Kerberos authentication. The KDC certificate that the client must validate for logon is expired, so the certificate path cannot be accepted even if the account and password state are otherwise normal.
Do not treat it as a user-certificate-only problem. The domain controller certificate and its renewal/enrollment path are the immediate focus.
What to inspect
- Inspect the domain-controller certificate validity period and template.
- Check auto-enrollment, CA availability, and whether old certificates remain selected by the KDC.
- Confirm that clients and domain controllers agree on time before judging validity.
References
- Microsoft: Kerberos authentication troubleshooting guidance
- Microsoft: Event 4771 Kerberos pre-authentication failed
- Microsoft: Certificate-based Kerberos authentication protections
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.