What does HRESULT 0x80090356 (SEC_E_NO_S4U_PROT_SUPPORT) mean?

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

The Kerberos subsystem encountered an error. A service for user protocol request was made against a domain controller which does not support service for user.

Previous	Next
SEC_E_SMARTCARD_CERT_EXPIRED	SEC_E_CROSSREALM_DELEGATION_FAILURE

SEC_E_NO_S4U_PROT_SUPPORT

The important part of SEC_E_NO_S4U_PROT_SUPPORT is its scope: S4U protocol support on the contacted domain controller. The service requested a Kerberos Service-for-User extension, but the KDC handling the request cannot provide the required S4U behavior. Keep the hexadecimal value 0x80090356 with the returning API, because higher-level software may translate it into a message that loses this distinction.

What the code establishes

Service-for-User is a Kerberos extension evaluated by the KDC, not a local password check in an S4U protocol support on the contacted domain controller investigation. Record whether the request is S4U2self or S4U2proxy, the service account and realm, target SPN, ticket flags, contacted domain controller, and the delegation configuration visible to that controller.

Facts to preserve before changing state

1. S4U stage, service principal, user principal, target SPN, source and target realms
Identify the domain controller and forest/domain functional environment used for the TGS exchange.
2. KDC or domain controller identity and its supported protocol behavior
Capture whether the request is S4U2self or S4U2proxy and the service account/SPN involved.
3. Delegation configuration, ticket flags, and the exact failure returned to SSPI
Check replication, DC selection, and compatibility before changing delegation permissions.

These observations are deliberately nonsecret: identifiers, lengths, provider names, policy selections, and state transitions usually support comparison without recording private keys, passwords, PINs, or plaintext.

Build a timeline before changing state

Authentication failures are multi-leg transactions. Align client SSPI calls, DNS and target-name resolution, policy refresh, domain-controller or KDC events, ticket acquisition, server acceptance, and any proxy or TLS transition. A single application timestamp is not enough to tell whether the decision was local policy, peer identity, context state, or KDC behavior in this condition investigation.

Package and target name, requested and returned context attributes, and each SSPI return in order.
In the path, relevant Group Policy result, SPN or UPN resolution, contacted DC/KDC, and ticket or certificate identities.
One permitted control target and one deliberately rejected target evaluated with the same client build in this condition investigation.

Isolation procedure

Test an in-realm target already allowed for constrained delegation before testing the failing cross-realm or unsupported path. This separates basic service-account configuration from the realm boundary or KDC capability that selected the status.

Preserve the original input, identity, provider or protocol selection, and first return Value.
Use one known-good control that changes only the suspected part of this path.
Reverse the comparison with known-good input on the failing layer where that can be done safely.
Record where behavior first diverges in this path instead of judging only by the final application message.

Common wrong turns

This code concerns protocol support at the KDC; an authorization failure from a capable KDC should be investigated as delegation policy instead. Changing application credentials does not add S4U support to a domain controller and does not extend a constrained-delegation allow-list., keep protocol capability and account authorization separate.

Also retain the original numeric value; neighboring constants can encode materially different remediation paths even when an application presents all of them as an authentication, certificate, or security failure.

Proving the intended path works

The intended KDC must issue the required ticket for the configured target and realm while preserving the expected delegation restrictions in this condition investigation. Keep a regression case that uses nonsecret identifiers and expected outcomes, including one negative control that must continue to fail.

Technical references

These sources define the HRESULT and the relevant relevant interface, protocol, or data format.

Looking for a different code? Search another status or error code.