| Previous | Next |
| SEC_E_NO_PA_DATA | SEC_E_SMARTCARD_LOGON_REQUIRED |
SEC_E_PKINIT_NAME_MISMATCH
SEC_E_PKINIT_NAME_MISMATCH signals this condition: The certificate UPN is missing, invalid, or does not match the identity in the smart-card logon request. PKINIT uses certificate-based Kerberos authentication. Windows requires the certificate identity and the requested account identity to map consistently; a mismatched UPN is a certificate issuance or account-mapping problem.
What to check
- Compare the user principal name in the certificate with the account name used for the logon request.
- Verify certificate validity, Smart Card Logon EKU, and the intended domain mapping.
- For cross-forest scenarios, review whether a user-name hint is needed instead of changing mappings blindly.
Microsoft: Smart-card certificate requirements
Looking for a different code? Search another status or error code.