Solved

Kerberos client received a KRB_AP_ERR_MODIFIED error

Posted on 2015-01-15
2
3,648 Views
Last Modified: 2015-01-27
Hi,

Our backup server is showing an error as below.

ID= 4; Src= Kerberos; User= ; Catg= ; D/T= 01/16/2015 08:02:02; EventDesc= The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server fwa-7ws09$. The target name used was RPCSS/fwa-ws004.xxx.net. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Please ensure that the target SPN is registered on, and only registered on, the account used by the server. This error can also happen when the target service is using a different password for the target service account than what the Kerberos Key Distribution Center (KDC) has for the target service account. Please ensure that the service on the server and the KDC are both updated to use the current password. If the server name is not fully qualified, and the target domain (FWA.NET.AU) is different from the client domain (xxx.NET), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

Interesting thing is that RPCSS/fwa-ws004.xxx.net does not exist in our network.
0
Comment
Question by:Educad
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 28

Accepted Solution

by:
Dan McFadden earned 500 total points
ID: 40553278
I would look thru your forward and reverse DNS zones for this host name.  If (when) you locate the record, not the IP address its pointing to, then find the active hostname of the device using that IP.  You will also want to search thru AD for an old computer account for the object "fwa-ws004.xxx.net" and delete it.

On the active host, you need to reset the Kerberos password.  This can be accomplished by restarting the complaining device, "fwa-7ws09."

These links describe the symptoms and resolutions:

- https://social.technet.microsoft.com/Forums/windowsserver/en-US/1712db04-0dd3-4f94-9f7c-a28daf9382c9/the-kerberos-client-received-a-krbaperrmodified-error?forum=winserverDS
- http://technet.microsoft.com/en-us/library/cc733987(v=WS.10).aspx

Dan
0
 
LVL 30

Expert Comment

by:Rich Weissler
ID: 40553317
Confirm "setspn -l fwa-ws004.xxx.net" doesn't return a relevant RPCSS record?
0

Featured Post

Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article shows the method of using the Resultant Set of Policy Tool to locate Group Policy that applies a particular setting.
Did you know that more than 4 billion data records have been recorded as lost or stolen since 2013? It was a staggering number brought to our attention during last week’s ManageEngine webinar, where attendees received a comprehensive look at the ma…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question