Windows 2000 Kerberos Ticket Decryption Failures

In Microsoft Windows 2000, Kerberos ticket decryption failures occur when a service cannot decrypt the Kerberos ticket presented by a client, usually due to mismatched cryptographic keys, expired passwords, or clock skew. When this failure takes place, Windows 2000 terminates the Kerberos authentication process, returns standardized Kerberos error codes, records diagnostic events in the system and security logs, and typically falls back to NTLM authentication if legacy protocols are permitted.

The Decryption Process and Cause of Failures

During a standard Kerberos authentication handshake, the Key Distribution Center (KDC) encrypts the service ticket using a secret symmetric key derived from the target service's account password. When the client presents this ticket (the AP-REQ) to the target server, the server attempts to decrypt it using its local service account password hash.

Decryption failures in Windows 2000 primarily occur under the following conditions:

  • Service Account Password Mismatch: If the password for the service account has been changed in Active Directory, but the running service has not updated its cached credentials or has not been restarted.
  • Service Principal Name (SPN) Duplication or Misconfiguration: If an SPN is registered to the wrong user or machine account, the ticket is encrypted with a key the destination host does not possess.
  • Clock Skew: Windows 2000 enforces a default maximum clock skew of five minutes. If the timestamp inside the authenticator exceeds this tolerance, the request is rejected immediately.
  • Corrupted Message Stream: In-transit tampering or network corruption that invalidates the cryptographic checksum.

Returned Kerberos Error Codes

When ticket decryption fails, the target server halts the ticket evaluation and returns a Kerberos protocol error to the client:

  • KRB_AP_ERR_MODIFIED (Error 41): This is the most common error returned when decryption fails. It indicates that the decrypt operation yielded invalid plaintext or that the authenticator checksum does not match, often pointing to an incorrect shared secret (password mismatch or duplicate SPN).
  • KRB_AP_ERR_BADKEYVER (Error 44): Returned if the Key Version Number (KVNO) embedded in the ticket does not match the key version currently stored on the host.
  • KRB_AP_ERR_SKEW (Error 37): Returned if the clock skew between the client and server exceeds the allowable threshold.

Protocol Fallback to NTLM

Windows 2000 utilizes the Negotiate Security Support Provider (SSP) (SPNEGO) for network authentication. When an application initiates a connection through Negotiate:

  1. Kerberos is attempted as the preferred protocol.
  2. If ticket decryption fails and the server returns an error such as KRB_AP_ERR_MODIFIED, the Negotiate security package captures the failure.
  3. If fallback is not disabled by security policy, Windows 2000 automatically downgrades the authentication attempt to NTLM (or NTLMv2).
  4. The client initiates a standard NTLM challenge-response exchange to complete the user's connection request, often masking the underlying Kerberos issue from the end user.

If NTLM is explicitly disabled via Local Security Policy or domain Group Policy, the connection attempt is terminated immediately, and an access-denied error (such as ERROR_LOGON_FAILURE) is returned to the user application.

Event Logging and Auditing

Windows 2000 records ticket decryption issues across both system and security event logs:

  • System Event Log: The Kerberos SSP logs warnings or errors indicating ticket failures, frequently under event source Kerberos (such as Kerberos Event ID 7), highlighting an invalid response or decryption issue.
  • Security Event Log: If "Audit Logon Events" or "Audit Account Logon Events" are enabled, Windows 2000 writes failure audit events. On domain controllers, this often surfaces as Event ID 675 (Pre-authentication failed) or Event ID 681 (Logon failed). On the target server, a failed logon attempt is recorded under Event ID 529 or Event ID 537.