Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Help! I screwed up big time. While trying to obtain the kerberos keys so i could decode some kerberos packets with wireshark, I inadvertently changed some internal passwords and I have no idea how to fix it. I am keenly aware of how stupid this was.

I used the ktpass app to and generate a keytab file, and apparently this also reset some internal password. Now I can no longer authenticate against the domain controller, and I get the event ID 4, with an message of:

The kerberos client received a KRB_AP_ERR_MODIFIED error from the server SERVER$. The target name used was INET\SSComPlus_be1. This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically named machine accounts in the target realm (INET.PRIV), and the client realm. Please contact your system administrator.

Can anyone help me here?

share|improve this question

2 Answers 2

You will need the Administrator password for the domain you are trying to connect to. If you have that password, then re-run the keytab generation, using that password. If you need somebody else to either give you the password or change it to the one you have used, then now is a good time to think about a good explanation.

share|improve this answer
up vote 0 down vote accepted

Turns out it was as easy as using adsiedit.msc and going to the affected account, then removing the serviceprinciplename attribute.

Serves me right for dinking with stuff I don't fully understand.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.