Kerberos Stops Working on an Windows XP SP2 Machine

Recently, I had the pleasure of encountering a fun little Kerberos problem. Basically, I was asked to troubleshoot and discover why SSO (via Kerberos) did not work for a group of users. Not a problem, I thought to myself as I jumped on a user’s machine and started walking through my usual series of troubleshooting steps. After some time had passed not seeing anything conclusive other then the following system event log message: LSASRV The Security System could not establish a secured connection with the server ldap/DC01.corp.com/corp.com@corp.com. No authentication protocol was available. I decided to load up Network Monitor 3.0 and take a look at the Kerberos traffic. To my surprise, there was none. Well, at least there were no Ticket-granting service (TGS) exchanges. The user was getting a Ticket Granting Ticket (TGT). But, when it came to a requesting a service ticket, Windows just didn’t even try. Seeing this, I thought that was very strange behavior and decided to search around the Microsoft support site for any KB articles that addressed similar issues with Kerberos. That is when I came across this article titled: “You cannot access network resources after you try to log on to a Windows XP Service Pack 2-based computer”. Needless to say, the symptoms were very similar to what some of the users were experiencing. Well at least the system event log message was. The other issues were only experienced by some of the users as the problem seemed to be either Kerberos authentication never worked or only sometimes worked. In either case, I was sold as this being the cause for some of the Kerberos problems as the KB also referenced a Hotfix. As quick as parent trying to find a Wii for their kids, I dialed up Microsoft Support and requested the Hotfix. After some negotiation, MS Support sent me the Hotfix, and I installed it on a machine to test. As expected, the results from the test were positive and the Hotfix seemed to correct the issues. Moral of the story: Looking at network traffic often gives you more insight then Windows event messages. :>) For all of today’s Microsoft news, visit Microsoft Subnet