| Previous | Next |
| ERROR_SMARTCARD_SUBSYSTEM_FAILURE | ERROR_MACHINE_LOCKED |
ERROR_DOWNGRADE_DETECTED
Domain authentication could not proceed without a security downgrade.
ERROR_DOWNGRADE_DETECTED is Win32 error 1265 (0x4F1). Its system message says that a domain controller cannot be contacted to service the authentication request. The constant name is significant: the authentication stack detected that completing the request would require an unacceptable downgrade or fallback rather than the expected domain authentication path.
Likely underlying conditions
- DNS or site selection directs the client to unavailable domain controllers
- Kerberos, Netlogon, LDAP, or required RPC traffic is blocked
- the machine secure channel is broken or its account password is inconsistent
- time skew prevents Kerberos while fallback is disabled by policy
- the requested encryption or authentication method is not shared by client and domain
Evidence to preserve
Capture the client, user and domain names, selected domain controller, DNS SRV answers, site, secure-channel state, Kerberos and Netlogon events, clock offset, allowed encryption types, and the protocol status immediately before 1265. Do not record user passwords or reusable ticket data. Separate “no controller found” from “controller contacted but authentication negotiation rejected.”
Diagnostic sequence
Verify domain DNS resolution and required network paths from the failing machine. Use domain-controller discovery and secure-channel diagnostics to identify the selected controller and test trust state. Check time synchronization and compare authentication policy on client, domain controllers, and target service.
Review recent hardening changes that disabled older NTLM behavior, weak Kerberos encryption, or unauthenticated fallback. The objective is not to re-enable obsolete protocols blindly, but to update the affected endpoint so it supports the required secure method.
Recovery
Restore domain-controller connectivity, repair the machine secure channel through supported administration, correct time or DNS, and align authentication capabilities. After the root cause is fixed, purge stale tickets when necessary and retry with the intended protocol. Cached interactive logon may let a user enter Windows, but it does not prove that fresh domain authentication is working.
Difference from nearby authentication codes
ERROR_NO_LOGON_SERVERS reports unavailable logon servers without emphasizing downgrade detection. ERROR_LOGON_FAILURE means credentials were rejected. Error 1265 warns that the requested authentication cannot safely continue through the available fallback path.
Example
After administrators disable an obsolete authentication method, one subnet cannot reach Kerberos ports on any domain controller. Applications return 1265 because the secure domain path is unavailable and weaker fallback is no longer permitted. Opening the required domain traffic resolves the issue without undoing the hardening policy.
References
- Microsoft: System Error Codes (1000–1299)
- Microsoft: Kerberos Authentication Troubleshooting
- Microsoft: Secure Channel Problems Detected
- Microsoft: Kerberos Authentication Overview
Looking for a different code? Search another status or error code.