The Microsoft Key Distribution Service is not starting on my DC (kdssvc.dll) and when I look at the event log under Microsoft\Kdssvc, I see the events:

Event ID 4001 Group Key Distribution Service failed to start. Status 0x80070020.

Event ID 4007
Group Key Distribution Service cannot connect to the domain controller on local host. Status 0x80070020. Group Key Distribution Service cannot be started because of the error. Please contact administrators to resolve the issue.

The error 0x80070020 indicates a file lock of some type.

Does anyone know how I can fix this error? Troubleshooting on the net for this is a bit sparse and is confused with the KDC.

For clarification: This question is not about Kerberos, instead it's about the service account that handles Group Managed Service Accounts (gMSA), Bitlocker, and Windows Activation Services in a corporate environment.

Update here is the procmon

enter image description here

  • 0x80070020 = ERROR_SHARING_VIOLATION (the process cannot access the file because it is being used by another process.) run procmon while trying to start the service and look for ERROR_SHARING_VIOLATION results. Here you could see which file causes it. Aug 30 '15 at 5:30
  • @magicandre1981 I did it, not sure if I did it right - see above... Aug 30 '15 at 12:14
  • this is not the error. look for ERROR_SHARING_VIOLATION entries Aug 30 '15 at 18:07
  • is your DC in a top-level OU? Or is it in a subOU?
    – user308418
    Sep 3 '15 at 19:33
  • I think @user308418 meant to task if the DC was in a top-level DOMAIN and not OU. All DCs are automatically put in the Domain Controllers OU of their domain and cannot be moved out of it.
    – SturdyErde
    Apr 19 '18 at 19:25

Validate that your DC is in the Default "Domain Controller" OU or the Service will fail. This is the only apparent impact of moving a DC that we experienced.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.