The 30-Second Fix: Check the Registry Flag
I've seen this error pop up on Windows Server 2016 and 2019 boxes when someone's been messing with Kerberos armoring or just after a security update. The quickest way to bypass the block is to disable chained evaluation directly on the domain controller that's throwing the error.
- Open
regediton the DC. - Go to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters - Create a new DWORD (32-bit) called
EnableCbacAndArmor. Set it to0. - Reboot the DC or restart the Kerberos Key Distribution Center service (
kdc).
That's it. If the error was caused by a stray policy setting, this kills it. But don't just set it and forget it—you're disabling a security feature. If you're in a test lab, fine. In production, you'll want to do the moderate fix below to make it permanent and controlled.
The 5-Minute Fix: Group Policy to Disable Chained Evaluation
If the registry hack worked but you need to apply it across multiple DCs (or you don't want to touch the registry on every box), use Group Policy. This is the clean way.
- Open Group Policy Management Console (GPMC).
- Create a new GPO linked to the
Domain ControllersOU. - Navigate to Computer Configuration → Policies → Administrative Templates → System → Kerberos.
- Find "Set maximum Kerberos tolerance for chained evaluation".
- Enable it and set the value to
0(zero). - Run
gpupdate /forceon the DCs and reboot them.
I've used this on a client's 2016 domain after a botched security update. The error was hitting every sign-in attempt from a particular remote site. The GPO fixed it in under ten minutes. But be careful—this setting affects all DCs, so if you have a mixed environment with older servers, test on one first.
The 15+ Minute Fix: Manual Flag via NLTEST or Script
Sometimes the GPO doesn't apply—maybe your DCs are in a separate site that doesn't get the policy, or you're dealing with a stubborn domain that won't refresh. In that case, you set the flag manually using a script. This is what I do when I'm in a hurry and can't wait for replication.
# PowerShell script to set the KDC registry flag on the local DC
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters" -Name "EnableCbacAndArmor" -Value 0 -Type DWord
Restart-Service kdc -Force
Run that as admin on each DC. But here's the thing—if you're seeing this error, it's usually because chained evaluation is actually broken. The flag just turns it off. That's a band-aid. The real fix is to figure out why the chain is failing.
Check the Event Viewer on the DC. Look for KDC event ID 11 or 16. Those tell you which domain or trust is failing. In my experience, it's almost always a broken trust relationship between two domains in the same forest. The chained evaluation tries to walk the trust path and dies when it hits a dead end.
If that's your case, the real fix is to repair the trust. Use netdom trust or the Active Directory Domains and Trusts snap-in. Don't skip this—because if you just disable chained evaluation, you're opening up your domain to Kerberos attacks that the setting was designed to prevent.
When to Stop and Just Do the Advanced Fix
If you're in a forest with multiple domains and you see this error on a DC that's a bridgehead for a site, don't waste time with the registry or GPO. Those are just suppressions. Jump straight to checking the trust health. Run this:
nltest /dsgettrustAnd check the trust's state. If it's not OK, that's your culprit. I had a client last month whose print queue server was failing auth because a child domain was decommissioned but the trust wasn't cleaned up. Chained eval choked on the orphaned trust, and the error showed up in the app logs as 0X00002088.
Once you fix the trust, the error goes away on its own, and you can keep chained evaluation enabled—which is what you want for security.
Final Word
Don't panic when you see this error. It's not a corruption bomb. Start with the registry flag to get things moving again, then use the GPO to make it consistent, and if that doesn't stick, dig into the trust relationships. Nine times out of ten, the answer is a broken trust, not a Kerberos feature you need to disable. And if you do disable it, remember to re-enable it after you've fixed the underlying issue.
Now go fix it—and don't call me unless the trust is gone.