Explanation of the Error
========================
This event will occur if you present a service ticket to a principal (target
computer) which cannot decrypt it. Normally the service ticket is encrypted using
the shared secret of the machine account's password as a basis for the encryption
used to encrypt the service ticket. The password is known only to the KDC (Domain
controllers) and the target machine. The client presents encrypted session ticket
it received from the KDC to the target server. If the server can decrypt the
ticket, the server then knows that it was encrypted by a trusted source (the DC)
and the presenter (the client) is also trusted. If the target server has a
different password than the DCs, the session ticket cannot be decrypted and the
failure occurs.
Here's an example of how this can happen with two identically named machine
accounts in separate forests. Suppose there are 2 machine accounts named FOO in
DomainA, and DomainB, but the server really lives in DomainB, then users in DomainA
would get the below error. Given a short name of FOO, users in DomainA would
acquire a service ticket to DomainA\FOO, and then present it to the DomainB\FOO
server.
DomainB\FOO doesn't have the same password as DomainA\FOO, so it can't decrypt the
service ticket.
There are 2 fixes for this scenario:
1) Access the server by the FQDN (e.g. FOO.DomainB.Com)
2) Delete the potentially unused server account (e.g. delete DomainA\Foo).
Other cases can cause this error:
=================================
1) WINS / DNS misconfiguration: The name of the target server is mistakenly
resolved to a different machine. To fix verify the resolved IP address actually
matches the target machine's IP address.
2) Service misconfiguration (server is actually running as
DomainB\SomeOtherAccount, but the service transport, RPC, CIFS, ..., is trying to
authenticate to the service DomainB\Foo).
3) Service is running on a cluster which isn't configured to use kerberos -
Basically the same as 2, where you're trying to authenticate to the cluster, but
you're actually authenticating to a node in the cluster, resulting in the above
error).
Resolution
==========
The first step is to identify all machines listed in the error above. Attempt to
locate the machines and determine their domain affiliation and current IP address.
If the machine is not in same domain as the client reporting the error, verify that
a duplicate computer does not exist in the local domain with the same name as one
listed in the error.
Next verify that the client reporting the error can correctly resolve the right IP
address for the client in question. Attempt a net use then check the netbios cache
(nbstat -c) and the dns cache (ipconfig /displaydns)
You can use the following method to determine of there are any duplicate machine
names registered in the same forest. Run the following command specifying the name
of a GC as ?GCName?
ldifde -f SPNdump.ldf -s GCName -t 3268 -d dc=forest,dc=root -r
"(objectclass=computer)" -l servicePrincipalName
Note that the above is one line wrapped for readability. Open the file and search
for all occurrences of the name list in the error 4 (omitting the $). This will
catch duplicates in the same forest. However it will not catch duplicates in
different forests. You will need rerun in all forest and search the output from
each.
