Kerberos Authentication Troubleshooting in Active Directory: klist, SPN and KDC

In Active Directory, Kerberos authentication problems can show up as access denied errors, repeated password prompts, an expected ticket that is never issued, or KDC events. To solve them I verify the ticket, SPN, DNS, time and service identity layers separately.

1. View the Kerberos tickets

klist

Check whether the expected service ticket for the service is there, and review the ticket details.

2. Test the ticket cache in a controlled way

klist purge

This clears the current Kerberos ticket cache. Do not run it in a production session without knowing the effect. Afterwards, access the target service again and watch a new ticket being issued.

3. Check the SPN registrations

setspn -Q HTTP/server.contoso.com
setspn -L CONTOSO\svc-web

Missing or duplicate SPNs are a common source of Kerberos problems. Before changing an SPN, verify which account the service actually runs under.

The domain, server and service account in the example are placeholders. Run setspn -L with the real service account.

4. Check for duplicate SPNs

setspn -X

If you find a duplicate, do not delete a registration before you have identified the real owner of the service.

5. DNS and DC discovery

nslookup server.contoso.com
nltest /dsgetdc:contoso.com

6. Time synchronization

w32tm /query /status
w32tm /query /source

Kerberos is sensitive to time differences. Check the domain time hierarchy and the time source of the PDC Emulator.

7. KDC and event logs

Review the Kerberos and KDC events in the System and Security logs for the time window of the error. Evaluate the error code together with the ticket, SPN, service account, DNS and time information.

My troubleshooting flow

1. Review the ticket state with klist.
2. Query the SPN for the target service.
3. Check for duplicate SPNs.
4. Verify DNS and DC discovery.
5. Check the time source.
6. Review the KDC and Security events on the same timeline.
7. After the fix, get a new ticket and test access again.

Service context and validation

klist shows the Kerberos tickets of the current session. To inspect the tickets of a service or computer account, use the right security context. After the fix, access the target service again and confirm that the expected service ticket is issued.

Conclusion

With Kerberos problems, clearing the ticket cache alone is not a permanent fix. Evaluate SPN ownership, DNS, time and KDC events together to find out at which stage the authentication chain breaks.

Related guides

If you also see replication errors, apply the DNS, RPC and time checks in Active Directory Replication Errors: Troubleshooting with Repadmin and DCDiag.

• The trust relationship between this workstation and the primary domain failed
• AD DNS and DC Locator troubleshooting
• Domain Controller time settings (Turkish)