-
Title
Cannot join with service account after enabling a group policy to disable RC4 and enable AES128 and 256. KRB5KDC_ERR_ETYPE_NOSUPP (-1765328370): KDC has no support for encryption type/ -
Description
Cannot join with service account after enabling a group policy to disable RC4 and enable AES128 and 256 receiving error: KRB5KDC_ERR_ETYPE_NOSUPP (-1765328370): KDC has no support for encryption type.
The following GPO was configured: Network Security: Configure encryption types allowed for Kerberos” setting with RC4 disabled, AES128/256 enabled.
We changed MsDS-SupportedEncryptionTypes set to 31 from 18 on all domain controller servers for the AD computer object for the client and enabled AES encryption type in the /opt/quest/vas/vas.conf . Once the encryption type was 31, then join command started to fail with unsupported encryption type.
In Windows Event Viewer under Security, EventID: 4769 is seen.
-
Resolution
1 - Enable the account for AES
To check the account in Active Directory right click the user and go to properties scroll down the list of account options.You should see use Kerberos DES encryption types for this accountThis account supports Kerberos AES 128bit encryptionThis account supports Kerberos AES 256 encryptionDo not require Kerberos preauthentication.We needed to Uncheck Use Kerberos DES encryption types for this account on the account.
2 - Setup the correct encryption in the /etc/opt/quest/vas/vas.conf file by doing the following command:/opt/quest/vas/vastool configure vas libdefaults default_etypes aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-963 - Ensure all domains and trusts support AES. For instruction go to KB186646
4 - Reset the password of the service account used to do the join after the encryption type has been changed.