| Previous | Next |
| STATUS_STACK_BUFFER_OVERRUN | STATUS_CROSSREALM_DELEGATION_FAILURE |
STATUS_NO_S4U_PROT_SUPPORT
The domain controller cannot process this S4U request
S4U2self and S4U2proxy extend Kerberos so a service can obtain tickets on behalf of a user, including constrained delegation scenarios. Both the service and KDC must recognize the extension. This status means the selected controller cannot perform that protocol path.
Verify which KDC issued the response and whether the request requires S4U2self or S4U2proxy. Falling back to unconstrained delegation or accepting a non-Kerberos identity changes the security model and is not an equivalent fix.
What to inspect
- Capture the KDC name, realm, service principal, and S4U request type.
- Check domain-controller version and whether all reachable KDCs support the extension.
- Review constrained-delegation configuration and service principal names before retrying.
References
- Microsoft Open Specifications: Kerberos S4U
- Microsoft Open Specifications: S4U2proxy
- Microsoft: Domain controller locator
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.