| Previous | Next |
| STATUS_KDC_CERT_EXPIRED | STATUS_PARAMETER_QUOTA_EXCEEDED |
STATUS_KDC_CERT_REVOKED
The KDC certificate fails revocation validation
This status means the certificate used by the domain controller for Kerberos certificate-based authentication is present but rejected by revocation checking. That is different from expiration, missing certificate, or an untrusted issuing CA.
The relevant evidence is the KDC certificate serial number, issuing CA, CRL/OCSP reachability, revocation reason, and the client or domain-controller event that reported the failure.
What to inspect
- Check the domain-controller certificate against the CA revocation data.
- Verify CRL distribution points and OCSP reachability from clients and domain controllers.
- Do not bypass revocation validation as a fix; repair the certificate or publication path.
References
- Microsoft: Kerberos authentication troubleshooting guidance
- Microsoft: Event 4771 Kerberos pre-authentication failed
- Microsoft: Certificate-based Kerberos authentication protections
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.