Re: Guidance Request – MIT Kerberos for Windows (4.0.1 / 4.1) Compatibility with Windows Server 2019

[Ken Hornstein]

I am not privy to the inner workings of the MIT Kerberos development team.
However, we do deploy MIT Kerberos for Windows in our environment and
I have recently contributed code for MIT Kerberos for Windows, so here
are my random thoughts.

1) MIT KfW 4.1 is based on the MIT Kerberos 1.13 release series, which was
   released in ... 2016.  So, 9 years ago. That fact alone suggests to me
   that updating MIT KfW releases based on newer versions of MIT Kerberos
   is not a high priority for the development team.

2) I know that that there is a fair amount of effort put into compatibility
   with the Microsoft Kerberos implementation, but since Windows Server
   2019 wasn't even out when MIT KfW 4.1 was released obviously no one
   was doing any compatibility testing with Windows Serveros 2019 back then.

3) Because of 1) and 2), I do not think anyone from MIT is going to
   answer your question.

4) However, my BEST GUESS is that it will "mostly work", as the Kerberos
   NETWORK PROTOCOL has been remarkably stable.  Things around the edges
   may or may not work; you're talking about almost decade-old binaries
   here (I'm specifically thinking about compatibility with the Windows
   credential cache).

5) In our environment we do not distribute KfW directly, but build our
   own release based on current MIT source code releases.  This works
   fine, as effort _is_ put into making sure that current MIT Kerberos
   builds fine on Windows.  I do not consider myself an experienced
   Windows developer, but I was able to follow the instructions to
   build MIT Kerberos on Windows just fine (I would describe the build
   process as "straightforward, but tedious").  I cannot offer any
   advice regarding compatibility with Windows Server, as our KDCs are
   MIT based.

Given all of the above, my advice to you is:

- You're going to have to do any testing yourself, as no one is likely to
  offer any answers to your questions.  However, I might be proven wrong!

- Your best bet going forward is to build MIT Kerberos for yourself based
  on the latest source code release, as that will likely offer the most
  compatibility with other Kerberos implementations.

--Ken

>Hi Team,
>
>Could you please share any updates ?
>
>Regards, Jenitha
>
>From: Jenitha Samuthiram Sent: Friday, August 22, 2025 1:00 AM To:
>'kerberos at mit.edu' <kerberos at mit.edu>; 'kfwdev at mit.edu' <kfwdev at mit.edu>
>Subject: RE: Guidance Request – MIT Kerberos for Windows (4.0.1 / 4.1)
>Compatibility with Windows Server 2019
>
>Hi,
>
>I wanted to kindly follow up on my previous mail regarding the
>compatibility of MIT Kerberos for Windows with Windows Server 2019.
>Could you please share any updates ?
>
>Regards, Jenitha
>
>From: Jenitha Samuthiram Sent: Tuesday, August 19, 2025
>10:12 PM To: kerberos at mit.edu<mailto:kerberos at mit.edu>;
>kfwdev at mit.edu<mailto:kfwdev at mit.edu> Subject: Guidance Request – MIT
>Kerberos for Windows (4.0.1 / 4.1) Compatibility with Windows Server
>2019
>
>Hello,
>
>As suggested by the MIT Kerberos Service Desk, I am contacting this
>mailing list for assistance with INC1623087.  Could anyone please
>confirm whether MIT Kerberos for Windows versions 4.0.1 and/or 4.1 are
>compatible with Windows Server 2019?  According to documentation:
>
>  * Version 4.0.1 lists support up to Windows Server 2008. * Version
>4.1 is “believed to work on current Windows Server releases,” but
>I could not find explicit confirmation for Windows Server 2019.  This
>information is critical as our customer’s production environment is
>pushing for clarity. Any official confirmation, guidance, or practical
>experiences (including known issues) would be greatly appreciated.
>
>Thank you, Jenitha
>
>________________________________________________________________________
>Kerberos mailing list Kerberos at mit.edu
>https://mailman.mit.edu/mailman/listinfo/kerberos