error codes

Windows event log entries often contain Kerberos failure codes (for an example, please see security event 676). These failure codes are the original error codes from the Kerberos RFC 1510 (see page 83 for the complete list).

For your convenience, we have extracted the error codes below and added some of our comments. Please note that in event log entries, a hexedicimal code is used (the number starts with 0x). Be sure to not mistakenly look up the decimal code below.

Error codes
Kerberos Error Label	Hex	Dec	Meaning or MIT code	Explanation
KDC_ERR_NONE	0x0	0	No error
KDC_ERR_NAME_EXP	0x1	1	Client’s entry in database has expired
KDC_ERR_SERVICE_EXP	0x2	2	Server’s entry in database has expired
KDC_ERR_BAD_PVNO	0x3	3	Requested protocol version number not supported
KDC_ERR_C_ OLD_MAST_KVNO	0x4	4	Client’s key encrypted in oldmaster key
KDC_ERR_S_ OLD_MAST_KVNO	0x5	5	Server’s key encrypted in old master key
KDC_ERR_C_ PRINCIPAL_UNKNOWN	0x6	6	Client not found in Kerberos database	We have seen this code when Active Directory replication does not work correctly. In this case, it is possible that e.g. a computer account joins the domain using one DC. Then, this information is not replicated within AD. If the computer then tries to authenticate to another DC, it is not found there, resulting in this error code. Also, make sure time synchronization between DCs is working well.
KDC_ERR_S_ PRINCIPAL_UNKNOWN	0x7	7	Server not found in Kerberos database	Could be the same cause as error 6 above.
KDC_ERR_ PRINCIPAL_NOT_UNIQUE	0x8	8	Multiple principal entries in database
KDC_ERR_NULL_KEY	0x9	9	The client or server has a null key
KDC_ERR_CANNOT_ POSTDATE	0xa	10	Ticket not eligible for postdating
KDC_ERR_NEVER_VALID	0xb	11	Requested start time is later than end time
KDC_ERR_POLICY	0xc	12	KDC policy rejects request
KDC_ERR_BADOPTION	0xd	13	KDC cannot accommodate requested option
KDC_ERR_ ETYPE_NOSUPP	0xe	14	KDC has no support for encryption type
KDC_ERR_SUMTYPE_NOSUPP	0xf	15	KDC has no support for checksum type
KDC_ERR_ PADATA_TYPE_NOSUPP	0x10	16	KDC has no support for padata type
KDC_ERR_TRTYPE_NOSUPP	0x11	17	KDC has no support for transited type
KDC_ERR_ CLIENT_REVOKED	0x12	18	Clients credentials have been revoked	This is due to a workstation restriction on the account, or a logon time restriction, or logon attempt outside logon hours, or accout disabled, expired, or locked out.
KDC_ERR_ SERVICE_REVOKED	0x13	19	Credentials for server have been revoked
KDC_ERR_TGT_REVOKED	0x14	20	TGT has been revoked
KDC_ERR_CLIENT_NOTYET	0x15	21	Client not yet valid – try again later
KDC_ERR_ SERVICE_NOTYET	0x16	22	Server not yet valid – try again later
KDC_ERR_KEY_ EXPIRED	0x17	23	Password has expired – change password to reset
KDC_ERR_ PREAUTH_FAILED	0x18	24	Pre-authentication information was invalid	Be sure to check time synchronization within your tree.
KDC_ERR_ PREAUTH_REQUIRED	0x19	25	Additional pre-authentication required
KRB_AP_ERR_ BAD_INTEGRITY	0x1f	31	Integrity check on decrypted field failed
KRB_AP_ERR_TKT_ EXPIRED	0x20	32	Ticket expired
KRB_AP_ERR_TKT_NYV	0x21	33	Ticket not yet valid
KRB_AP_ERR_REPEAT	0x22	34	Request is a replay
KRB_AP_ERR_NOT_US	0x23	35	The ticket isn’t for us
KRB_AP_ERR_BADMATCH	0x24	36	Ticket and authenticator don’t match
KRB_AP_ERR_SKEW	0x25	37	Clock skew too great
KRB_AP_ERR_BADADDR	0x26	38	Incorrect net address
KRB_AP_ERR_ BADVERSION	0x27	39	Protocol version mismatch
KRB_AP_ERR_MSG_TYPE	0x28	40	Invalid msg type
KRB_AP_ERR_MODIFIED	0x29	41	Message stream modified
KRB_AP_ERR_ BADORDER	0x2a	42	Message out of order
KRB_AP_ERR_ BADKEYVER	0x2c	44	Specified version of key is not available
KRB_AP_ERR_NOKEY	0x2d	45	Service key not available
KRB_AP_ERR_MUT_FAIL	0x2e	46	Mutual authentication failed
KRB_AP_ERR_ BADDIRECTION	0x2f	47	Incorrect message direction
KRB_AP_ERR_METHOD	0x60	48	Alternative authentication method required*
KRB_AP_ERR_BADSEQ	0x31	49	Incorrect sequence number in message
KRB_AP_ERR_ INAPP_CKSUM	0x32	50	Inappropriate type of checksum in message
KRB_ERR_GENERIC	0x3C	60	Generic error (description in e-text
KRB_ERR_FIELD _TOOLONG	0x3D	61	Field is too long for this implementation

If you get an error with the Event ID 115, an error occured while logging into the ODBC-Database.
WinSyslog then writes the error code in the NTEventLog-Text.

See the table below to find out what the error-codes describes:

Errorcode	Errordescription
01000	General warning
01001	Cursor operation conflict
01002	Disconnect error
01003	NULL value eliminated in set function
01004	String data, right-truncated
01006	Privilege not revoked
01007	Privilege not granted
01S00	Invalid connection string attribute
01S01	Error in row
01S02	Option value changed
01S06	Attempt to fetch before the result set returned the first rowset
01S07	Fractional truncation
01S08	Error saving File DSN
01S09	Invalid keyword
07001	Wrong number of parameters
07002	COUNT field incorrect
07005	Prepared statement not a cursor-specification
07006	Restricted data type attribute violation
07009	Invalid descriptor index
07S01	Invalid use of default parameter
08001	Client unable to establish connection
08002	Connection name in use
08003	Connection does not exist
08004	Server rejected the connection
08007	Connection failure during transaction
08S01	Communication link failure
21S01	Insert value list does not match column list
21S02	Degree of derived table does not match column list
22001	String data, right-truncated
22002	Indicator variable required but not supplied
22003	Numeric value out of range
22007	Invalid datetime format
22008	Datetime field overflow
22012	Division by zero
22015	Interval field overflow
22018	Invalid character value for cast specification
22019	Invalid escape character
22025	Invalid escape sequence
22026	String data, length mismatch
23000	Integrity constraint violation
24000	Invalid cursor state
25000	Invalid transaction state
25S01	Transaction state
25S02	Transaction is still active
25S03	Transaction is rolled back
28000	Invalid authorization specification
34000	Invalid cursor name
3C000	Duplicate cursor name
3D000	Invalid catalog name
3F000	Invalid schema name
40001	Serialization failure
40002	Integrity constraint violation
40003	Statement completion unknown
42000	Syntax error or access violation
42S01	Base table or view already exists
42S02	Base table or view not found
42S11	Index already exists
42S12	Index not found
42S21	Column already exists
42S22	Column not found
44000	WITH CHECK OPTION violation
HY000	General error
HY001	Memory allocation error
HY003	Invalid application buffer type
HY004	Invalid SQL data type
HY007	Associated statement is not prepared
HY008	Operation canceled
HY009	Invalid use of null pointer
HY010	Function sequence error
HY011	Attribute cannot be set now
HY012	Invalid transaction operation code
HY013	Memory management error
HY014	Limit on the number of handles exceeded
HY015	No cursor name available
HY016	Cannot modify an implementation row descriptor
HY017	Invalid use of an automatically allocated descriptor handle
HY018	Server declined cancel request
HY019	Non-character and non-binary data sent in pieces
HY020	Attempt to concatenate a null value
HY021	Inconsistent descriptor information
HY024	Invalid attribute value
HY090	Invalid string or buffer length
HY091	Invalid descriptor field identifier
HY092	Invalid attribute/option identifier
HY095	Function type out of range
HY096	Invalid information type
HY097	Column type out of range
HY098	Scope type out of range
HY099	Nullable type out of range
HY100	Uniqueness option type out of range
HY101	Accuracy option type out of range
HY103	Invalid retrieval code
HY104	Invalid precision or scale value
HY105	Invalid parameter type
HY106	Fetch type out of range
HY107	Row value out of range
HY109	Invalid cursor position
HY110	Invalid driver completion
HY111	Invalid bookmark value
HYC00	Optional feature not implemented
HYT00	Timeout expired
HYT01	Connection timeout expired
IM001	Driver does not support this function
IM002	Data source name not found and no default driver specified
IM003	Specified driver could not be loaded
IM004	Driver’s SQLAllocHandle on SQL_HANDLE_ENV failed
IM005	Driver’s SQLAllocHandle on SQL_HANDLE_DBC failed
IM006	Driver’s SQLSetConnectAttr failed
IM007	No data source or driver specified; dialog prohibited
IM008	Dialog failed
IM009	Unable to load translation DLL
IM010	Data source name too long
IM011	Driver name too long
IM012	DRIVER keyword syntax error
IM013	Trace file error
IM014	Invalid name of File DSN
IM015	Corrupt file data source

WinSyslog

The Enhanced Syslog Server

Tag Archives: error codes

What are the various Kerberos error codes?

Error codes

EventLog ID 115 – ODBC Error codes