Windows error 1397 (ERROR_MUTUAL_AUTH

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: the client could not verify the server identity during mutual authentication.

Previous	Next
ERROR_WRONG_TARGET_NAME	ERROR_TIME_SKEW

ERROR_MUTUAL_AUTH_FAILED

Authentication credentials were exchanged, but server identity validation failed

Mutual authentication requires the client to establish that the responder is the intended service principal, not merely to prove the client identity to a server. Windows Kerberos/SSPI exposes wrong-principal and target-recognition failures during context establishment. The Win32 text also points to a server password that is out of date at the domain controller, which can leave the service unable to use the key expected for its Kerberos ticket.

Check the requested SPN, the account that owns it, and the account under which the service actually runs. Kerberos KRB_AP_ERR_MODIFIED commonly indicates that the ticket was encrypted with key material different from what the target service can use, for example because an SPN is on the wrong account or a machine/service password is inconsistent. Capture both client and server Kerberos events. Avoid bypassing mutual authentication until the principal and key ownership mismatch is understood.

What to inspect

Compare requested SPN, SPN owner, and actual service identity.
Check Kerberos event 4/KRB_AP_ERR_MODIFIED on both client and server.
Verify machine or service account password/key consistency with the domain.

References

Looking for a different code? Search another status or error code.