| Previous | Next |
| STATUS_NO_PA_DATA | STATUS_SMARTCARD_LOGON_REQUIRED |
STATUS_PKINIT_NAME_MISMATCH
The PKINIT certificate identity does not match the user
PKINIT uses X.509 public-key data during the Kerberos initial authentication exchange. In Windows smart-card logon, the certificate must map to the account being authenticated; common mapping evidence includes the UPN in certificate extensions and, on updated domain controllers, strong certificate mapping requirements.
This status should be investigated as a certificate-to-account mapping problem, not as a PIN-only failure. The card can be readable and the private key can be usable while the certificate identity still fails the KDC name checks.
What to inspect
- Inspect the certificate UPN, SAN, issuer, template, and account mapping.
- Check domain-controller KDC events for the precise PKINIT failure and mapping path.
- Verify recent certificate-mapping hardening changes on domain controllers.
References
- Microsoft Open Specifications: MS-PKCA PKINIT in Kerberos
- RFC 4556: PKINIT
- Microsoft: Smart card certificate requirements
- Microsoft Open Specifications: NTSTATUS values
- Microsoft Support: certificate-based authentication changes
Looking for a different code? Search another status or error code.