I've recently added a few Windows 2008 servers to my Windows 2003 domain. Now my domain controllers are periodically posting Security event ID 675 for the Windows 2008 boxes (only and all of the Win2k8 boxes):

Pre-authentication failed:
    User Name:  MY2008SERVER$
    User ID:        MYDOMAIN\MY2008SERVER$
    Service Name:   krbtgt/MYDOMAIN.LOCAL
    Pre-Authentication Type:    0x0
    Failure Code:   0x19
    Client Address:

According to Microsoft, that failure code means "Additional pre-auth required." As nedm noted, the actual RFC says 0x19 means "Server credentials revoked." Logon auditing yielded no useful information. Time is properly synced.

I've found a number of similar reports on the web and the only answer I've seen so far is to set the "Don't require Kerberos pre-auth flag" via ADSIEdit.

This is fine as a workaround, but I don't want to have to do this for every 2008 server I deploy. Any idea where this is coming from? How to fix it for real?


0x19 corresponds to 19 in hex notation which is 25 in decimal: "Additional pre-authentication required*"

  • Good catch. I'd upvote this as a comment, but not as an answer. – sh-beta Dec 3 '09 at 15:57

I think that with Windows 2008, NTLM was eliminated as an authentication method. This leaves Kerberos as the only option. We had a similar problem when we fielded 2008 machines in our test environment. It turned out that the clocks were sufficiently out of sync (i.e. >5 minutes) from the domain time. The 2003 machines worked fine since they simply fell back to NTLM when Kerberos failed. Ensuring that the machines all had a common NTP source (set via GPO) fixed our issue.

  • Bear in mind that these errors are logged by my domain controller's auditing policies - I hear about it when my 2003 boxes fail kerberos auth. Time is configured properly. – sh-beta Nov 17 '09 at 22:28

Kerberos error (0x)19 actually corresponds to 'credentials for server have been revoked' -- see the RFC for a list of kerberos error codes -- very helpful for troubleshooting. Additional preauthentication (0x25) means there's more specific error data available in the error-type field (you can refer to section 5.9.1 of the RFC), but again, 0x19 indicates the server's credentials aren't functioning properly.

Though it usually causes yet a different error, I'd check the time skew of the 2008 servers first. Next I'd try removing them from then re-joining to the domain.

  • Added a link to MS's site where they label 0x19 as additional pre-auth required. Interesting discrepancy, though. Time is correctly configured on these boxes. I'll test removing/rejoining them to the domain, but given that it's happening with ALL my 2008 boxes that's an unlikely fix. – sh-beta Nov 17 '09 at 22:26
  • See David's explanation above - decimal vs hex. – sh-beta Dec 3 '09 at 15:58

For Kerberos messages I always check that the server's SPN's (Service Principal Names) are not duplicated. Kerberos seems to use SPN's to attach to user/computer accounts, not name/CN/samaccountname. ADSIEdit can be used to see the SPN's and search for dupes.

  • Good idea, but they're all unique. – sh-beta Dec 3 '09 at 16:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.