2k3 (SP1) and PDC Emulator difference

[Douglas E. Engert]

Markus Moeller wrote:
> Check also the kvno (key version number). 2000 doesn't increment it, whereas 
> 2003 does, so you can get different kvnos from 2000 and 2003 kdcs. But there 
> is a patch form MS which allows to configure 2003 to act like a 2000 kdc wrt 
> to kvnos.

If you have the MIT KfW or Unix, try the kvno utility to get a service ticket,
and see what kvno the KDC returnes. Then make sure the keytab file has the key
with that kvno.


> 
> Regards
> Markus
> 
> "amol dixit" <dixitamol at yahoo.com> wrote in message 
> news:20050928201447.43903.qmail at web52408.mail.yahoo.com...
> 
>>Hi,
>>I have Windows 2k and 2k3 (SP1) AD servers in a
>>domain, and if I set the 2k server as the
>>OperationsMaster->PDC (aka. PDC Emulator), then
>>DES_CBC_MD5 key generated using the SPN (and
>>corresponding Salt) fails to authenticate on 2k3
>>server. It automatically forwards the kerberos ticket
>>request (AS_REQ) to the PDC Emulator (which is the 2k
>>server), which in turn authenticates the SPN using the
>>same key. Also, kinit can get a ticket from 2k3 for
>>the same account without forwarding to PDC.
>>I am at a loss to explain how come the same kerberos
>>DES key works on 2k but not on 2k3, even though the
>>account is created on 2k3 AD.
>>Interestingly, if I make the 2k3 server as PDC master,
>>it will authenticate using the same key and not
>>forward the request to the 2k server anymore.
>>PDC emulators are for legacy windows clients, I dont
>>see what role is plays here.
>>Any ideas, please let me know.
>>TIA,
>>Amol
>>
>>
>>
>>
>>__________________________________
>>Yahoo! Mail - PC Magazine Editors' Choice 2005
>>http://mail.yahoo.com
>>________________________________________________
>>Kerberos mailing list           Kerberos at mit.edu
>>https://mailman.mit.edu/mailman/listinfo/kerberos
>>
> 
> 
> 
> 
> ________________________________________________
> Kerberos mailing list           Kerberos at mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
> 
> 

-- 

  Douglas E. Engert  <DEEngert at anl.gov>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444