| Previous | Next |
| SEC_E_CRYPTO_SYSTEM_INVALID | SEC_E_MUST_BE_KDC |
SEC_E_MAX_REFERRALS_EXCEEDED
SEC_E_MAX_REFERRALS_EXCEEDED signals this condition: Kerberos exceeded the allowed number of ticket referrals. Kerberos referrals normally direct a client toward the realm or domain that owns a target service. Reaching the maximum often indicates a referral loop, a wrong target realm, or a trust and naming configuration that cannot resolve the service cleanly.
What to check
- Confirm the target FQDN, DNS suffix, and SPN used by the client.
- Check trust paths and domain-controller events for repeated referral behavior.
- Look for duplicate or stale SPNs before altering trust configuration.
setspn -Q HTTP/server.contoso.comMicrosoft: Kerberos authentication troubleshooting
Looking for a different code? Search another status or error code.