Kerberos-Key-Distribution-Center warning ID 32

Question

Hi Support,

Our DC will have a warning 32 on the Kerberos-Key-Distribution-Center:

The Key Distribution Center (KDC) uses a certificate without KDC Extended Key Usage (EKU) which can result in authentication failures for device certificate logon and smart card logon from non-domain-joined devices. Enrollment of a KDC certificate with KDC EKU (Kerberos Authentication template) is required to remove this warning.

Our device didn't use smartcard or device certificate to login, any idea?

Answer 1

Hello Chong,

Thank you for posting in Q&A forum.

How many Domain Controllers are there in your domain? Do you see the same event ID on all the DCs in your domain?

Please check if you have an internal Windows CA server in your domain? If so, you can check if there is KDC certificate in Certificates - Local Computer\Personal store.

If you have Windows CA and there is such certificate (issued using Kerberos Authentication certificate template) on DC, you can try to request such Kerberos certificate on DC, then check if there is still this warning on DC.

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.