Access to local resources from Entra Joined devices

Question

A few months ago we started using Intune and I Entra Joined some devices. We have two DC onsite, one of them is the CA.

The problem that I'm finding is that if a user logs on using a PIN from Entra Joined device they're not able to access shared folder on the domain. "The System cannot contact a domain controller to service the authentication request".

I followed the Cloud Kerberos trust deployment guide

https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust

I also created new certificate template as per https://dirteam.com/sander/2022/09/14/todo-upgrade-the-certificates-for-your-windows-server-2016-based-domain-controllers-and-up-to-enable-windows-hello-for-business-hybrid-scenarios/

Errors I'm seeing include 0x14 KDC_ERR_TGT_REVOKED and "Trust Validation of the certificate for the Kerberos Distribution Center (KDC) CA.contoso.com failed"

I've also reviewed this guide to no avail:

https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-deployment-issues

I've spent tens of hours at this to no avail. Any input would be appreciated.