Error Code: 0x7 KDC_ERR_S_PRINCIPAL_UNKNOWN LDAP/Localhost

Adamecz Zoltán 0

Hi!

"In the event log, an entry like this appears every 5 minutes. How do I fix it?"

A Kerberos error message was received:

on logon session

Client Time:

Server Time: 13:55:10.0000 9/10/2024 Z

Error Code: 0x7 KDC_ERR_S_PRINCIPAL_UNKNOWN

Extended Error:

Client Realm:

Client Name:

Server Realm: Contoso.com

Server Name: LDAP/localhost

Target Name: LDAP/localhost@Contoso.com

Error Text:

File: onecore\ds\security\protocols\kerberos\client2\kerbtick.cxx

Line: 1286

Error Data is in record data.

By entering this, I received another error message:

setspn -A LDAP/localhost Contoso.com\administrator."

A Kerberos error message was received:

on logon session

Client Time:

Server Time: 13:45:10.0000 9/10/2024 Z

Error Code: 0x29 KRB_AP_ERR_MODIFIED

Extended Error:

Client Realm:

Client Name:

Server Realm: Contoso.com

Server Name: dc01$

Target Name:

Error Text:

File: onecore\ds\security\protocols\kerberos\client2\ctxtapi.cxx

Line: 5a1

Error Data is in record data.

"So this is not the solution, but what should I enter to make it work?"

"Of course, I replaced the domain name with contoso.com."

Adamecz Zoltán 0

"I expanded the error with some Wireshark results. Out of 100 computers, 5-6 have Kerberos errors. What should I do next?

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

XXX Wireshark filter: kerberos.error_code == 0x7 XXXXXXXXXXXXXXXXXXXXXXXXXX

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Transmission Control Protocol, Src Port: 88, Dst Port: 43049, Seq: 1, Ack: 1995, Len: 89

Kerberos

Record Mark: 85 bytes

0... .... .... .... .... .... .... .... = Reserved: Not set

.000 0000 0000 0000 0000 0000 0101 0101 = Record Length: 85

krb-error

pvno: 5

msg-type: krb-error (30)

stime: Sep 26, 2024 13:52:57.000000000 Central Europe Daylight Time

susec: 898367

error-code: eRR-S-PRINCIPAL-UNKNOWN (7)

realm: Contoso.HU

sname

    name-type: kRB5-NT-SRV-INST (2)

    sname-string: 2 items

        **SNameString: krbtgt**

        SNameString: \

[Response to: 3509214]

[Time from request: 0.001151000 seconds]

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Another:

Transmission Control Protocol, Src Port: 88, Dst Port: 60108, Seq: 1, Ack: 1720, Len: 118

Kerberos

Record Mark: 114 bytes

0... .... .... .... .... .... .... .... = Reserved: Not set

.000 0000 0000 0000 0000 0000 0111 0010 = Record Length: 114

krb-error

pvno: 5

msg-type: krb-error (30)

stime: Sep 26, 2024 14:10:04.000000000 Central Europe Daylight Time

susec: 794455

error-code: eRR-S-PRINCIPAL-UNKNOWN (7)

realm: Contoso.HU

sname

    name-type: kRB5-NT-SRV-INST (2)

    sname-string: 2 items

        SNameString: **MSSQLSvc**

        SNameString: devopssql.Contoso.hu:64234

[Response to: 3775349]

[Time from request: 0.007355000 seconds]

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Another:

Transmission Control Protocol, Src Port: 88, Dst Port: 59432, Seq: 1, Ack: 1774, Len: 96

Kerberos

Record Mark: 92 bytes

0... .... .... .... .... .... .... .... = Reserved: Not set

.000 0000 0000 0000 0000 0000 0101 1100 = Record Length: 92

krb-error

pvno: 5

msg-type: krb-error (30)

stime: Sep 26, 2024 13:52:38.000000000 Central Europe Daylight Time

susec: 60645

error-code: eRR-S-PRINCIPAL-UNKNOWN (7)

realm: Contoso.HU

sname

    name-type: kRB5-NT-SRV-INST (2)

    sname-string: 2 items

        **SNameString: DNS**

        SNameString: nsa1.isp.hu

[Response to: 3506305]

[Time from request: 0.013072000 seconds]

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Another:

Transmission Control Protocol, Src Port: 88, Dst Port: 54723, Seq: 1, Ack: 1668, Len: 98

Kerberos

Record Mark: 94 bytes

0... .... .... .... .... .... .... .... = Reserved: Not set

.000 0000 0000 0000 0000 0000 0101 1110 = Record Length: 94

krb-error

pvno: 5

msg-type: krb-error (30)

stime: Sep 26, 2024 13:01:25.000000000 Central Europe Daylight Time

susec: 668941

error-code: eRR-S-PRINCIPAL-UNKNOWN (7)

realm: Contoso.HU

sname

    name-type: kRB5-NT-SRV-INST (2)

    sname-string: 2 items

        **SNameString: ldap**

        SNameString: Contoso.hu

[Response to: 2575430]

[Time from request: 0.000532000 seconds]

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

What should I do next?

1 answer

Zunhui Han 2,085 Reputation points Microsoft Vendor

2024-09-10T14:41:20.54+00:00

Hello,

Thank you for posting in Q&A forum.

KDC_ERR_C_PRINCIPAL_UNKNOWN means the domain controller does not know which client principal it should use to encrypt the ticket.To resolve this, determine if the requestor has the correct UPN.

For more details, I suggest you refer to the following link：

https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/kerberos-errors-in-network-captures/ba-p/400066

I hope the information above is helpful.

Best regards

Zunhui

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Please sign in to rate this answer.
Adamecz Zoltán 0 Reputation points

2024-09-26T12:39:35.3866667+00:00

"Thank you, it helped me that I installed Wireshark to see the data flow. But unfortunately, I don't know how to proceed." "I expanded the error with some Wireshark results. Out of 100 computers, 4-5 have Kerberos errors."
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Error Code: 0x7 KDC_ERR_S_PRINCIPAL_UNKNOWN LDAP/Localhost

1 answer

Your answer