KDC Proxy implementation issue

Question

Hello,

I am writing because I wanted to test implementing KDC Proxy for Kerberos authentication from outside the network in my lab with a view to replacing traditional VPNs before potentially rolling it out to the production environment at my company.

However, I have been stuck for days due to a client-side error:

"The Kerberos client could not send a Kerberos proxy request.

ProxyServer:

ServerName: kdcproxy.ad.domain.com

ServerPort: 443

ServerVdir: KdcProxy

Error Code: 0x2F8F

Status Code: 0xC000005E"

This appears to be related to an inability to send Kerberos requests.

I do not see any logs on the KDC Proxy itself; I can only see the communication via Wireshark, though it appears to be terminated immediately by the client.

Any suggestion?

Thank you in advance.

Answer 1

Hello,

The error 0x2F8F with status 0xC000005E means the client is failing during the TLS handshake with the KDC Proxy, so the Kerberos request never leaves the client. This is almost always caused by certificate trust issues. Make sure the certificate bound to port 443 on the proxy includes kdcproxy.ad.domain.com in the SAN and that the full chain is trusted by the client. If the certificate is self-signed or issued by an internal CA, import the root CA into the client’s trusted store.

Next, confirm the IIS virtual directory /KdcProxy is correctly configured with KerberosAuth.dll loaded and the app pool running under NetworkService. The web.config under C:\Windows\KdcProxy must list your domain controllers in AllowedKdcProxyHosts. On the client side, check the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\KdcProxy\ProxyServers to ensure the FQDN, port 443, and virtual directory are correctly defined.

Use Wireshark to verify whether the TLS handshake completes. If you see a fatal alert like “Unknown CA” or “Handshake Failure,” that confirms certificate trust is the root cause. For deeper visibility, enable the KDC Proxy operational log with wevtutil sl "Microsoft-Windows-KdcProxy/Operational" /e:true and review events under Applications and Services Logs > Microsoft > Windows > KdcProxy > Operational.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

Hoang Le.