| Previous | Next |
| STATUS_SMARTCARD_LOGON_REQUIRED | STATUS_KDC_UNABLE_TO_REFER |
STATUS_KDC_INVALID_REQUEST
Where this sits in Kerberos processing
STATUS_KDC_INVALID_REQUEST indicates that the Key Distribution Center rejected a request as invalid. This is not equivalent to a failed password check. The client and KDC have reached a Kerberos protocol exchange, but the request cannot be processed as constructed: the requested principal, options, pre-authentication data, realm context, ticket request or a vendor-specific extension may be inconsistent with the KDC’s rules.
Kerberos V5 defines structured error responses for the authentication and ticket-granting exchanges, while Windows adds documented KILE behavior. The result is therefore most useful when paired with the actual Kerberos failure code, client/KDC event data and a packet trace or client trace captured with appropriate safeguards. A generic retry often sends the same invalid request again.
Narrow the request rather than guessing
- Identify whether the failure occurred during TGT acquisition, service-ticket acquisition, delegation, or a smart-card/PKINIT path.
- Record the client principal, target service principal, realm, requested options and the KDC’s detailed error.
- Confirm that DNS, realm mapping, service principal names and time are correct before modifying encryption or trust policy.
- Compare a working client request with the failing one to locate the materially different field or extension.
References
- Microsoft Open Specifications: NTSTATUS reference
- RFC 4120: Kerberos V5
- Microsoft Open Specifications: Kerberos Protocol Extensions (MS-KILE)
- Microsoft: Event 4771, Kerberos pre-authentication failed
Looking for a different code? Search another status or error code.