Event ID 13 — Kerberos Key Integrity

  • Article

Applies To: Windows Server 2008 R2

Kerberos keys are created by the Key Distribution Center (KDC) and derived from the password of the user account. These keys are used by the Kerberos client to communicate with the Kerberos KDC in a secure manner.

Event Details

Product: Windows Operating System
ID: 13
Source: Microsoft-Windows-Kerberos-Key-Distribution-Center
Version: 6.1
Symbolic Name: KDCEVENT_CORRUPT_CREDENTIALS
Message: The account for %1 has corrupt keys stored in the DS. Changing or setting the password should restore correct keys.

Resolve

Reset the account password

To resolve this issue, you must reset the password of the user account that has corrupt Kerberos keys.

Note: The name of the user account is identified in the event message log.

To perform this procedure, you must be a member of the Domain Admins group, or you must have been delegated the appropriate authority.

To reset the account password by using Active Directory Users and Computers:

  1. Log on to a computer that has Active Directory Users and Computers installed. It is installed by default on a domain controller.
  2. Click Start, point to Administrative Tools, and then click Active Directory Users and Computers.
  3. Navigate to the organizational unit where the user account is stored. By default, this organizational unit is named Users.
  4. Right-click the user account, and then click Reset Password.
  5. In the New password box, type the new password.
  6. In the Confirm Password box, retype the password.
  7. Select the User must change password at next logon check box, and then click OK.
  8. Close Active Directory Users and Computers.

Verify

A valid Kerberos key is required to get a Kerberos ticket from the Kerberos Key Distribution Center (KDC). To verify that the Kerberos keys are valid and functioning correctly, you should ensure that a Kerberos ticket was received from the KDC and cached on the local computer. You can view cached Kerberos tickets on the local computer by using the Klist command-line tool.

Note: Klist.exe is not included with Windows Vista, Windows Server 2003, Windows XP, or Windows 2000. You must download and install the Windows Server Resource Kit before you can use Klist.exe.

To view cached Kerberos tickets by using Klist:

  1. Log on to a Kerberos client computer within your domain.
  2. Click Start, point to All Programs, click Accessories, and then click Command Prompt.
  3. Type klist tickets, and then press ENTER.
  4. Verify that a cached Kerberos ticket is available.
    • Ensure that the Client field displays the client on which you are running Klist.
    • Ensure that the Server field displays the domain in which you are connecting.
  5. Close the command prompt.

Kerberos Key Integrity

Core Security