Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using Windows Server 2008 and Windows Vista and 7 for cross realm authentication using MIT Kerberos 1.6 but when i try to login with a user the KDC answers:

(wireshark output)


I want to know how can I change the encryption type method to be compatible with the KDC (i tried a XP client and it worked fine).

(posted this yesterday on superuser, but I guess this is more a serverfault question)

Can anyone help me on this ?

Many thanks!

share|improve this question

The following two links have some detailed information on the SupportedEncryptionTypes configuration for Kerberos:

In general, you need to have common algorithm between the KDC and your Windows machines. If you are running more recent version of MIT Kerberos, you should have AES support, but if your KDC is older one, you would need to use DES to interop. @tommed is correct that DES is disabled by default in Win7, but it should work fine on Vista.

Alternatively, capture the network traffic between the KDC and your client machine and look at what the client is offering and look at the KDC config to ensure you have at least one of the crypto algorithms in common.

share|improve this answer

What encryption type are you using? Did you specify the encryption type when you created the host policy? If not it'll probably be using DES which is disabled by default in Windows 7

Try enabling DES and trying again. Also make sure your time is in sync with your server!

Hope that helps!! :)

share|improve this answer
BTW, I'm trying to get the exact same thing working too, if you could help with my question I'd be very grateful!… – tommed Apr 6 '10 at 18:24

This sounds similar in principle to an SSL error I just worked through.
If a certificate is involved, make sure that it was generated using the CNG option in the certificate request wizard rather than the Legacy Key option.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.