Kerberos hanging on startup

[Jobos]

I've got a problem with the Kerberos service on a server 2003 box that I don't know how to fix

 

When the server is restarted it's taking a very long time before the logon box appears and I'm getting errors about the kerberos service hanging. Here is the time line from the event log:

 

8:34 event log started

8:38 kerberos key distribution centre hung on startup

8:53 Application popup warning about service not starting

8:56 kerberos key distribution centre starts

 

There are two servers (server A and server B) and it's server A with the problem. I've run dcdiag on both servers and it reports no problem but netdiag on server A reports “kerberos does not have a ticket for host”.

[Jobos]

Anyone?

[mrmontymick]

I've got a problem with the Kerberos service on a server 2003 box that I don't know how to fix

 

When the server is restarted it's taking a very long time before the logon box appears and I'm getting errors about the kerberos service hanging. Here is the time line from the event log:

 

8:34 event log started

8:38 kerberos key distribution centre hung on startup

8:53 Application popup warning about service not starting

8:56 kerberos key distribution centre starts

 

There are two servers (server A and server B) and it's server A with the problem. I've run dcdiag on both servers and it reports no problem but netdiag on server A reports “kerberos does not have a ticket for host”.

 

Netdiag often returns “kerberos does not have a ticket for host” because the Server 2003 version of netdiag doesn't work properly.

 

Have you tried using Klist instead? It's in the Resource Kit. That may provide more useful information.

[Jobos]

I have, but I don't know what I'm looking for!

 

Server A has 7 cached tickets and server B has 6 cached tickets.

[mrmontymick]

I have, but I don't know what I'm looking for!

 

Server A has 7 cached tickets and server B has 6 cached tickets.

 

Does the server A have a TGT for itself?

 

If you stop and restart the KDC once the server has started does it do it quickly or is it as slow as initial start-up?

[Jobos]

Does the server A have a TGT for itself?

 

If you stop and restart the KDC once the server has started does it do it quickly or is it as slow as initial start-up?

 

Sorry to sound thick but what does TGT mean?

[mrmontymick]

Sorry to sound thick but what does TGT mean?

 

Sorry, way to geeky moment there, TGT = Ticket Granting Ticket. The master ticket if you like which allows you authenticate to all other Kerberos services.

 

The restart question is probably the more important of the two to have an answer to....

[Jobos]

KDC took 90 seconds to restart. I see from the event log that while KDC was restarting there were a number of crypt32 errors event ID 8

 

Failed auto update retrieval of third-party root list sequence number from: with error: This network connection does not exist

 

All updates are done via WSUS on server B

Edited February 23, 2010 by Jobos

[mrmontymick]

KDC took 90 seconds to restart. I see from the event log that while KDC was restarting there were a number of crypt32 errors event ID 8

 

 

 

All updates are done via WSUS on server B

 

I take it the server doesn't have any form of internet access available to it then?

 

The looks like it's trying to perform a security certificate update and is unable to do so.

[Jobos]

I take it the server doesn't have any form of internet access available to it then?

 

The looks like it's trying to perform a security certificate update and is unable to do so.

 

The server does have internet access. I'll do the test again and this time test the internet when KDC is down.

[Jobos]

I did a test before I went home tonight and the internet works fine when KDC service is stopped.