KDC Hatası

Merhaba

Bu bir hata değil . Eğer ortamda smart card ile logon işlemi olmayacak ise bu uyarıyı görmezden gelebilirsiniz. Veya bir ortamınızda bir CA var ise bir kdc sertifikası alarak uyarıdan kurtulabilirsiniz.

To resolve this issue:

• Delete the domain controller certificate that is no longer valid.
• Request a new certificate.

To perform these procedures, you must be a member of the Domain Admins group, or you must have been delegated the appropriate authority.

Delete the domain controller certificate that is no longer valid

To delete the domain controller certificate that is no longer valid:

1. On the domain controller in which the issue is occurring, click Start, and then click Run.
2. Type mmc.exe, and then press ENTER.
3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
4. Click File, and then click Add/Remove Snap-in.
5. Click Certificates, and then click Add.
6. Click Computer account, click Next, and then click Finish.
7. Click OK to open the Certificates snap-in.
8. Expand Certificates (Local computer), expand Personal, and then click Certificates.
9. Right-click the old domain controller certificate, and then click Delete.
10. Click Yes, confirming that you want to delete the certificate.
11. After the certificate is deleted, follow the procedure in the "Request a new certificate" section.

Request a new certificate

To request a new certificate:

1. Expand Certificates (Local computer), right-click Personal, and then click Request New Certificate.
2. Complete the appropriate information in the Certificate Enrollment Wizard for a domain controller certificate.
3. Close the Certificates snap-in.

Verify

To perform this procedure, you must be a member of the Domain Admins group, or you must have been delegated the appropriate authority.

To verify that the Kerberos Key Distribution Center (KDC) certificate is available and working properly:

1. Log on to a computer within your domain.
2. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
4. At the command prompt, type certutil -dcinfo verify, and then press ENTER.
5. If you receive a successful verification, the Kerberos KDC certificate is installed and operating correctly.

smart card ile logon olayı düşünmediğim için bu uyarıyı tamamen kapatma şansım var mı

Merhabalar,

 Windows Server 2008 server'lar üzerinde aşağıdaki registry değerini oluşturarak gerekli uyarinin cikmasini engelleyebilirsiniz.
 

 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\kdc]

"UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors"=dword:00000001

Bu DWORD değerimi 1 yapin, daha sonra sunucuda KDC Servisini Restart yapin.

Kerberos istemciler artik expire olan CRL'lerden  dolayi olusan "Revocation unknown" hatalari gözardi edilecektir. 

iyi calismalar,

Mesut ALADAĞ
Microsoft MVP

Mesut Bey merhaba. Sizin söylediğinizi yaptıktan sonra root dc ( win 2003 ) de aşağıdaki hatalarla karşılaşmaya başladım. KDC hatası normalde additional dc ( win 2008 ) de mevcuttu. Fakat söylediklerinizi yaptıktan sonra additional dc de hata kalkmasına rağmen root dc de aşağıdaki hatalar oluştu. Durumu eski haline almak zorunda kaldım. İstediğiğiniz dosyaları da mail attım.