| Previous | Next |
| ERROR_CSCSHARE_OFFLINE | ERROR_SMARTCARD_SUBSYSTEM_FAILURE |
ERROR_PKINIT_FAILURE
PKINIT could not validate the KDC certificate.
ERROR_PKINIT_FAILURE is Win32 error 1263 (0x4EF). During smart-card domain sign-in, Kerberos uses Public Key Cryptography for Initial Authentication (PKINIT). The client must trust and validate the certificate presented for the Key Distribution Center; failure in that certificate validation path stops the logon before ordinary ticket use.
Certificate conditions to examine
- the KDC certificate is expired, not yet valid, revoked, or missing an expected purpose
- the issuing certification authority is absent from the client trust or enterprise NTAuth path
- the certificate name or domain-controller identity does not match the contacted KDC
- revocation information cannot be reached under the sign-in network conditions
- domain controllers have inconsistent certificates after enrollment or renewal
Evidence to preserve
Collect System, Security, Kerberos, KDC, CAPI2, and smart-card events from the client and contacted domain controller. Record the certificate thumbprint, issuer, subject, validity interval, enhanced key usages, chain status, revocation result, domain controller name, client time, and selected smart-card certificate. Do not log the card PIN or export private keys.
Diagnostic sequence
Confirm accurate time on the client and domain controller, then identify the exact KDC used for the failed attempt. Build and validate its certificate chain from the client’s perspective, including enterprise trust and revocation access. Compare a failing domain controller with one that successfully accepts smart-card sign-in.
Verify that certificate enrollment and renewal completed on every domain controller and that old certificates were not removed before replacements became usable. Check DNS and site selection because a client may contact a distant controller with different PKI state. When Remote Desktop is involved, also inspect where certificate validation occurs and whether the required KDC certificate chain is available to the client.
Recovery
Correct the KDC certificate, trust chain, revocation publishing, time synchronization, or domain-controller selection. After PKI state is repaired, purge only the necessary cached Kerberos tickets and retry. Do not weaken certificate validation or disable revocation checks globally to make sign-in work; that removes the mutual-authentication protection PKINIT is intended to provide.
Difference from smart-card subsystem failure
ERROR_SMARTCARD_SUBSYSTEM_FAILURE points to the reader, card, resource manager, minidriver, or cryptographic-provider path. Error 1263 is narrower: the PKINIT exchange reached KDC certificate validation and failed there.
Example
Smart-card users can sign in through one site but not another. Clients at the failing site select a domain controller whose renewed KDC certificate chains to a CA not yet published in enterprise trust. The event log and thumbprint identify the affected controller; correcting certificate enrollment restores PKINIT without changing card policy.
References
- Microsoft: System Error Codes (1000–1299)
- Microsoft: Certificate Requirements and Enumeration
- Microsoft: PKINIT in the Kerberos Protocol
- Microsoft: Enabling Smart Card Logon
Looking for a different code? Search another status or error code.