| Previous | Next |
| STATUS_MAX_REFERRALS_EXCEEDED | STATUS_STRONG_CRYPTO_NOT_SUPPORTED |
STATUS_MUST_BE_KDC
The Kerberos operation requires a KDC role
This status appears when code reaches a Kerberos path that is only meaningful on a Key Distribution Center. In an Active Directory domain that normally means a domain controller, not a workstation or member server that merely consumes Kerberos tickets.
The important distinction is role and placement. Client-side repair such as clearing a ticket cache will not make a member server able to issue KDC referrals, validate PKINIT as a KDC, or perform domain-controller-only Kerberos work.
What to inspect
- Confirm that the operation is running on the intended domain controller.
- Check whether the machine lost its domain-controller role or the caller contacted the wrong host.
- Correlate the status with KDC service, domain controller discovery, and Kerberos event logs.
References
- Microsoft Open Specifications: MS-KILE Kerberos extensions
- RFC 4120: Kerberos V5
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: Kerberos troubleshooting guidance
Looking for a different code? Search another status or error code.