Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have problem when tryging to generate a kytab file using msktutil. When I generate this file it fails with following errors Error: Unable to set machine password for svc_testmyapps: (5) Access denied Error: set_password failed

My environment/tool:

  • msktutil 0.5
  • RedHat 5


  • I asked Active Directory admins:

    • Create a Service Account (svc_testmyapps) with a password that does not expire
    • Add Service Principles to this Service Account

      setspn.exe -A HTTP/testmyapps.myorg.com svc_testmyapps
      setspn.exe -A HTTP/testmyapps1.myorg.com svc_testmyapps
      setspn.exe -A HTTP/testmyapps2.myorg.com svc_testmyapps

  • After that I what to create a kytab file. On server which will serve HTTP services I did following actions:

    • kinit svc_testmyapps@EU.MYORG.COM

      Password for svc_testmyapps@EU.MYORG.COM: Entered valid password

    • klist

      Ticket cache: FILE:/tmp/krb5cc_0 Default principal: svc_testmyapps@EU.MYORG.COM

      Valid starting Expires Service principal 07/10/13 21:40:57 07/11/13 07:41:14 krbtgt/EU.MYORG.COM@EU.MYORG.COM renew until 07/11/13 21:40:57

      Kerberos 4 ticket cache: /tmp/tkt0 klist: You have no tickets cached

    • Now I try to generate kytab file with following command:

      msktutil --create --use-service-account --service HTTP/testmyapps.myorg.com --keytab /etc/krb5.keytab --account-name svc_testmyapps --user-creds-only --no-pac --verbose

    And it fails with following stack trace

    -- init_password: Wiping the password structure 
    -- generate_new_password: Generating a new, random password for the service account
    -- generate_new_password:  Characters read from /dev/udandom = 88
    -- get_dc_host: Attempting to find a Domain Controller to use (DNS SRV RR TCP) 
    -- get_dc_host: Found DC: eudc01.eu.myorg.com
    -- get_dc_host: Canonicalizing DC through forward/reverse lookup...
    -- get_dc_host: Found Domain Controller: eudc01.eu.myorg.com
    -- create_fake_krb5_conf: Created a fake krb5.conf file: /tmp/.msktkrb5.conf-Z4ZZTx
    -- reload: Reloading Kerberos Context
    -- finalize_exec: SAM Account Name is: svc_testmyapps
    -- try_user_creds: Checking if default ticket cache has tickets...
    -- finalize_exec: Authenticated using method 4
    -- ldap_connect: Connecting to LDAP server: eudc01.eu.myorg.com try_tls=YES
    -- ldap_connect: Your LDAP version does not support the option to disable reverse lookups
    -- ldap_connect: Connecting to LDAP server: eudc01.eu.myorg.com try_tls=NO
    -- ldap_connect: Your LDAP version does not support the option to disable reverse lookups
    SASL/GSSAPI authentication started
    SASL username: svc_testmyapps@EU.MYORG.COM
    SASL SSF: 56
    SASL installing layers
    -- ldap_connect: LDAP_OPT_X_SASL_SSF=56
    -- ldap_get_base_dn: Determining default LDAP base: dc=EU,dc=MYORG,dc=COM
    -- get_default_ou: Determining default OU: OU=New Users,OU=_Common,OU=TEAD,DC=eu,DC=myorg,DC=com
    -- ldap_check_account: Checking that a service account for svc_testmyapps exists
    -- ldap_check_account: Checking service account - found
    -- ldap_check_account: Found userAccountControl = 0x10200
    -- ldap_check_account: Found supportedEncryptionTypes = 28
    -- ldap_check_account:   Found Principal: HTTP/testmyapps1.myorg.com
    -- ldap_check_account:   Found Principal: HTTP/testmyapps2.myorg.com
    -- ldap_check_account:   Found Principal: HTTP/testmyapps.myorg.com
    -- ldap_check_account:   Found User Principal: svc_testmyapps
    -- ldap_check_account_strings: Inspecting (and updating) computer account attributes
    -- ldap_set_supportedEncryptionTypes: No need to change msDs-supportedEncryptionTypes they are 28
    -- ldap_set_userAccountControl_flag: Setting userAccountControl bit at 0x200000 to 0x0
    -- ldap_set_userAccountControl_flag:  userAccountControl not changed 0x10200
    -- ldap_set_userAccountControl_flag: Setting userAccountControl bit at 0x2000000 to 0x1
    -- ldap_set_userAccountControl_flag: ldap_modify_ext_s failed (Insufficient access)
    -- set_password: Attempting to reset service account's password
    -- set_password: Try change password using user's ticket cache
    -- ldap_get_pwdLastSet: pwdLastSet is 130179332336793337
    Error: Unable to set machine password for svc_testmyapps: (5) Access denied
    Error: set_password failed
    Hint: Does your password policy allow to change svc_testmyapps's password?
        For example, there could be a "Minimum password age" policy preventing
        passwords from being changed too frequently. If so, you can reset the
        password instead of changing it using the --user-creds-only option.
        Be aware that you need a ticket of a user with administrative privileges
        for that.
    -- ~msktutil_exec: Destroying msktutil_exec
    -- ldap_cleanup: Disconnecting from LDAP server
    -- init_password: Wiping the password structure
    -- ~KRB5Context: Destroying Kerberos Context
    1. Is commend for msktutil correct if I what to create kytab file?
    2. Why it try to change password for svc_testmyapps Service Account?
    3. What I must to do to generate kytab file?
share|improve this question
I needed wait 24h, because in Active Directory is defined that password minimum age is 24h –  user1124133 Aug 8 '13 at 8:40
add comment

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.