asked on
Kerberos error
I have 3 Hyper-V hosts. Servers are Windows Server 2012 R2. All of them are reporting error in event viewer:
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server server3$. The target name used was HTTP/ourserver.domain.com.
If I try to refresh page on Server Manager the error is:
Error ourserver : Configuration refresh failed with the following error: The metadata failed to be retrieved from the server, due to the following error: WinRM cannot process the request. The following error with errorcode 0x80090322 occurred while using Kerberos authentication: An unknown security error occurred.
Ourserver in DNS has 3 A records and IP are the same as Server1, Server2 and Server3.
I can connect with domain accounts to servers. Why is this happening?
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server server3$. The target name used was HTTP/ourserver.domain.com.
If I try to refresh page on Server Manager the error is:
Error ourserver : Configuration refresh failed with the following error: The metadata failed to be retrieved from the server, due to the following error: WinRM cannot process the request. The following error with errorcode 0x80090322 occurred while using Kerberos authentication: An unknown security error occurred.
Ourserver in DNS has 3 A records and IP are the same as Server1, Server2 and Server3.
I can connect with domain accounts to servers. Why is this happening?
Windows OSWindows Server 2012Hyper-V
Last Comment
Casey Weaver
Have you checked for any time skew? Are the hosts domain joined, or using local admin accounts?
Hello,
Please validate the following links, they can help you solve your problem:
https://social.technet.microsoft.com/Forums/windowsserver/en-US/8c9a71d8-7490-47f4-b0e4-69695b0aa3a7/the-kerberos-client-received-a-krbaperrmodified-error-between-dc-after- primary-dc-migrated-to-vm?
https://social.technet.microsoft.com/Forums/windowsserver/en-US/a819a0a5-ab47-4470-b354-d39d47d57251/kerberos-krbaperrmodified-error?forum=winserverDS
we remain attentive to your comments.
Please validate the following links, they can help you solve your problem:
https://social.technet.microsoft.com/Forums/windowsserver/en-US/8c9a71d8-7490-47f4-b0e4-69695b0aa3a7/the-kerberos-client-received-a-krbaperrmodified-error-between-dc-after- primary-dc-migrated-to-vm?
https://social.technet.microsoft.com/Forums/windowsserver/en-US/a819a0a5-ab47-4470-b354-d39d47d57251/kerberos-krbaperrmodified-error?forum=winserverDS
we remain attentive to your comments.
ASKER CERTIFIED SOLUTION
THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
ASKER
Time is ok, they are domain joined. They are joined to failover cluster. But in dns there is a record ourserver, which is pointing to 3 ip (all of three hyper-v hosts). Servercluster is on different name and IP than "ourserver".
Maybe you have an idea or from experience, why was it built this way.
Maybe you have an idea or from experience, why was it built this way.
Hello,
DNS resolution answers by name and ip?
Do not erase any DNS record, put your DNS zone ServerCluster is called like this?
Pointing to your Hyper-V host
I remain attentive to your comments.
Regards...
DNS resolution answers by name and ip?
Do not erase any DNS record, put your DNS zone ServerCluster is called like this?
Pointing to your Hyper-V host
I remain attentive to your comments.
Regards...
ASKER
No there is server1, server2, server3. It's Hyper-V hosts.
The failover cluster has name Servercluster and separate IP and dns entry. Ourserver is also failover cluster name (don't know why architect made two names). In dns Ourserver has 3 A records, which are same as servers. But the guy who worked before said he remember that Servercluster and Ourserver had same one IP and A record.
In addition Server 3 and Servercluster have each the same two IP's. It was never like this before, because they have one teamed interface.
The failover cluster has name Servercluster and separate IP and dns entry. Ourserver is also failover cluster name (don't know why architect made two names). In dns Ourserver has 3 A records, which are same as servers. But the guy who worked before said he remember that Servercluster and Ourserver had same one IP and A record.
In addition Server 3 and Servercluster have each the same two IP's. It was never like this before, because they have one teamed interface.
Hello,
You can create new records and validate.
Without deleting the other records, or taking note of those records, delete them and create new records.
I remain attentive to your comments.
Regards...
You can create new records and validate.
Without deleting the other records, or taking note of those records, delete them and create new records.
I remain attentive to your comments.
Regards...
Proper diagnostic steps are given.