Error The Kerberos client received a KRB_AP_ERR_MODIFIED

Question

I'm getting an error on several machines,

The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server nb-16$. The target name used was HOST/WS-11.COP.NET. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (COP.NET) is different from the client domain (COP.NET), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server

Answer 1

Hello Marcos Santos,

Thank you for posting in Q&A forum.

1.Please check HOST/WS-11.COP.NET is registered on which machine. Run SETSPN -L machinename to check.
Please check if you have duplicate SPN, run setspn -X to check.

2.Please check AD replication work fine. Run commands below on PDC.

repadmin /showrepl >C:\rep1.txt

repadmin /replsum >C:\rep2.txt

repadmin /showrepl * /csv >c:\repsum.csv

3.Please check check there is DNS issue on these several machines.

4.Check if the several machines you mentioned are in the same domain as server nb-16$. If the several machines you mentioned are in different domain as server nb-16$, please check if the client domain have one server with the same name server nb-16$.

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

I did the procedure as requested as shown below I did it both on the server and on the NB-16 machine