Windows Server 2016 Error Log: Account krbtgt is missing from the Kerberos Key Distribution Center; While processing another ticket request, the Key Distribution Center (KDC) encountered a ticket that did not contain the account information for the ticket

Question

There is a primary domain controller in the environment, Windows Server 2008R2, and a secondary domain controller, Windows Server 2016. Now I have purchased a Windows Server 2022 system server and plan to upgrade it to the primary domain controller. But I found that there are two errors that appear frequently in the system log of Windows Server 2016:

1）、The Kerberos Key Issuance Center is missing account krbtgt.

The password for this account must be updated to prevent the use of insecure encryption.

See https://go.microsoft.com/fwlink/?linkid=2215265

2）、The Key Issuance Center (KDC), while processing another ticket request, encountered a ticket that did not contain the account information for which the ticket was requested. This prevents security checks from running and may open security holes. See https://go.microsoft.com/fwlink/?linkid=2173051 for more information

I looked at it and it said that I need to install an update and then modify the key value in the registry.

But I downloaded the update ((KB5008601)) to Windows Server 2016, but it prompted me that I could not install it. Other updates also prompted that they were expired and could not be downloaded. I could not find the required value (PacRequestorEnforcement) in the registry.

Here are the previously installed updates:

I would like to ask how to solve these two errors. Thank you very much.

Answer 1

Hi @Dongdong Xu

Please start by checking Active Directory health by running the following commands:

repadmin /showrepl

dcdiag

Did you try to reset krbtgt password?

Regarding PacRequestorEnforcement please read the link below

https://support.microsoft.com/en-us/topic/kb5008380-authentication-updates-cve-2021-42287-9dafac11-e0d0-4cb8-959a-143bd0201041

---

Please don’t forget to accept helpful answer

Answer 2

This one could help.

https://dirteam.com/sander/2022/11/09/knowledgebase-you-experience-errors-with-event-id-42-and-source-kdcsvc-on-domain-controllers/

As to KB5008601 this is the November 14, 2021(OS Build 14393.4771) Out-of-band update and would not apply if the current build is a higher level which you can check.

winver

--please don't forget to close up the thread here by marking answer if the reply is helpful--