Kerberos Armoring (FAST) Failure on Legacy Domain Controllers

Question

Hi everyone,

After enforcing Kerberos FAST through Group Policy, domain controllers running at mixed functional and OS levels started rejecting TGT requests with KRB_AP_ERR_MODIFIED.

The issue appears to be related to cross-generation realm key validation, since authentication succeeds when FAST is switched back to Opportunistic.

Has anyone run into this before? What's the recommended approach for troubleshooting realm key derivation or armor ticket validation inconsistencies across mixed-generation domain controllers?

Thanks,

John

Answer 1

Welcome to Microsoft Q&A!

Thank you for providing the detailed error information.

Based on your description, this behavior is often seen when Kerberos Armoring (FAST) is enforced before all domain controllers can consistently process armored authentication requests. Kerberos FAST was introduced in Windows Server 2012 and requires compatible domain controllers, appropriate domain functional levels, and consistent Kerberos policy configuration across the environment. This is a recommendation that applying the KDC support for claims, compound authentication and Kerberos armoring policy consistently to all domain controllers.

A few points stand out:

• If authentication succeeds when FAST is configured as Supported/Opportunistic but fails when enforcement is enabled, this typically indicates a compatibility or configuration inconsistency rather than a client credential issue.
• KRB_AP_ERR_MODIFIED generally indicates that Kerberos data could not be decrypted or validated using the expected key. This error is associated with key mismatches, duplicate or incorrect SPNs, encryption-type inconsistencies, replication issues, or different key material being used by participating systems.
• In mixed-generation domain environments, verify that all domain controllers have consistent KRBTGT information, support the same Kerberos encryption types (AES is recommended), and are fully updated. Inconsistent encryption settings or replication of Kerberos-related secrets can produce failures that resemble FAST armor ticket validation problems.

For troubleshooting, I recommend the following:

1. Review KDC, Kerberos, LsaSrv, and Netlogon event logs on all participating domain controllers during a failed authentication attempt. It is a recommendation starting with the exact events recorded by the client and KDC.
2. Capture a network trace (Wireshark or netsh trace) and determine at which stage the failure occurs:

• FAST armor TGT acquisition
• AS-REP processing
• TGS request processing
• Cross-DC referral handling

3. Verify Active Directory replication health and confirm that KRBTGT password version numbers (KVNOs) and related Kerberos secrets are consistent across all domain controllers.
4. Check the msDS-SupportedEncryptionTypes attribute on domain controller computer accounts and ensure AES encryption is enabled consistently throughout the environment. Inconsistent encryption-type configuration has been known to cause Kerberos authentication failures.
5. Confirm that all domain controllers involved support Kerberos Armoring and that the KDC support for claims, compound authentication and Kerberos armoring policy is configured consistently across the domain. I recommend you applying this policy to all domain controllers.
6. If legacy domain controllers are still present, consider leaving FAST in Supported/Opportunistic mode until all domain controllers support Kerberos Armoring and have been validated for consistent behavior. Older domain controller generations do not support claims, compound authentication, or armoring.

For additional information, please visit:

Compound Authentication and Active Directory Domain Services claims in Active Directory Federation Services | Microsoft Learn

ADMX_kdc Policy CSP | Microsoft Learn

Kerberos client receives KRB_AP_ERR_MODIFIED error - Windows Server | Microsoft Learn

Kerberos Authentication Troubleshooting Guidance - Windows Server | Microsoft Learn

Troubleshoot Kerberos failures - Internet Information Services | Microsoft Learn

IIS 7+ Kerberos authentication failure: KRB_AP_ERR_MODIFIED | Microsoft Learn

If the answer is helpful, please click Accept Answer.

Thank you for using Microsoft Q&A.