Fix Kerberos error 0x80090356 – SEC_E_NO_S4U_PROT_SUPPORT

I know this error is annoying. You try to authenticate, and bam – 0x80090356 pops up with SEC_E_NO_S4U_PROT_SUPPORT. It usually happens when you're connecting to a server or a service that uses Kerberos, like Exchange or SharePoint. The real fix is simple: your computer's clock is wrong.

Quick fix – sync your clock with the domain controller

Kerberos is picky about time. If your system clock is off by more than 5 minutes (default skew), it refuses to issue tickets. Here's how to fix it:

Open Command Prompt as Administrator. Click Start, type cmd, right-click it, and pick Run as administrator.
Type w32tm /resync and press Enter. After you hit Enter, you should see The command completed successfully.
If that fails (it does sometimes), run these two commands in order:
```
net stop w32time
w32tm /unregister
w32tm /register
net start w32time
w32tm /resync
```
After each line, wait for a response. The service stops, unregisters, registers again, starts, then resyncs. You should see success messages.
Check the time. Open Settings > Time & Language > Date & time. Turn on Set time automatically and Set time zone automatically if they're off. The time should match your domain controller.

That's it. In 9 out of 10 cases, this kills the error. If it doesn't, read on.

Why this works

Kerberos uses timestamps to prevent replay attacks. When you request a ticket, your machine sends its current time. The domain controller checks that against its own clock. If the difference is bigger than 5 minutes (default), it rejects the request with error 0x80090356. The w32tm /resync command forces Windows to fetch the correct time from the domain controller. Problem solved.

Less common variations

Sometimes the clock isn't the culprit. Here are other causes I've seen:

Domain controller time is wrong

If the DC itself has bad time, syncing your machine won't help. Log into a DC and run w32tm /resync there. Or check the PDC emulator – it's the master time source. Use w32tm /query /source to see where the DC gets its time. It should point to an external NTP server like time.windows.com.

DNS resolution fails

Kerberos needs to find the domain controller via DNS. If your machine can't resolve the DC's name, the error shows up. Run nslookup yourdomain.local (replace with your domain). You should get an IP address. If not, check your DNS settings in the network adapter – set it to the DC's IP.

Network time protocol (NTP) is blocked

Firewalls sometimes block UDP port 123, which is what NTP uses. If you can't sync, check if port 123 is open between your machine and the DC. A quick test: run telnet dcIP 123 – if it fails, the port is blocked. Talk to your network team.

How to prevent it from happening again

Do these three things and you'll rarely see 0x80090356:

Enable automatic time sync. On domain-joined machines, this is set by Group Policy. But if someone changed it, manually set it: w32tm /config /syncfromflags:domhier /update. Run that as admin.
Check your time zone. If the time zone is wrong (say, Eastern when you're in Pacific), the time offset can cause an error. Set it correctly in Settings.
Monitor the PDC emulator. Make sure it's syncing to a reliable external time source. Use w32tm /query /status to confirm. If it's off, fix it. All other machines in the domain follow it.

One more thing: old hardware with failing CMOS batteries can drift time badly. If you keep seeing this error on the same machine, replace the motherboard battery (usually a CR2032). I've fixed a dozen machines that way.

That's the whole thing. Sync your clock, check DNS, and keep the PDC healthy. The error will vanish.