| Previous | Next |
| SEC_E_MAX_REFERRALS_EXCEEDED | SEC_E_STRONG_CRYPTO_NOT_SUPPORTED |
SEC_E_MUST_BE_KDC
SEC_E_MUST_BE_KDC signals this condition: The requested operation requires a Kerberos Key Distribution Center, but the local computer is not a domain controller. The operation was attempted in a role that cannot perform KDC-only work. This is a deployment or application-targeting error, not a sign that the current workstation needs to become a domain controller.
What to check
- Identify the component that issued the request and which host it expected to act as the KDC.
- Verify DNS and domain-controller discovery rather than directing KDC traffic to an arbitrary server.
- Check whether an application configuration incorrectly points a KDC-only operation at a member server or client.
Microsoft: Kerberos authentication troubleshooting
Looking for a different code? Search another status or error code.