| Previous | Next |
| STATUS_KDC_INVALID_REQUEST | STATUS_KDC_UNKNOWN_ETYPE |
STATUS_KDC_UNABLE_TO_REFER
The KDC could not build a Kerberos referral
Kerberos referrals let a client move from one realm or domain to another when requesting service tickets. This status means the KDC could not construct the next referral for the target service or namespace.
Do not treat it as a generic bad password result. Useful evidence is the target SPN, realm/domain suffix, trust path, DNS name canonicalization, and whether the KDC has enough trust information to choose a referral target.
What to inspect
- Check the requested SPN and realm/domain suffix exactly as sent by the client.
- Verify trust relationships and name suffix routing between domains or forests.
- Compare KDC events with network traces of AS/TGS exchanges.
References
- Microsoft Open Specifications: MS-KILE Kerberos extensions
- RFC 4120: Kerberos V5
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: Kerberos troubleshooting guidance
Looking for a different code? Search another status or error code.