You're at the login screen, you slide in your smart card, type your PIN, and instead of a desktop you get an error. On the client it might say "The certificate is expired" or just a generic authentication failure. In the event log you'll see STATUS_KDC_CERT_EXPIRED with error code 0XC000040E. This happens specifically when a user tries to do smart card logon against a domain controller whose Kerberos certificate has passed its expiration date.
The root cause is simple: every DC needs a valid certificate with the KDC Authentication extended key usage (EKU) to accept smart card logons. That cert is used to sign the initial Kerberos ticket request. If it's expired, the DC can't issue a TGT, so the logon fails. You're not dealing with a network issue or a client problem — it's the server's cert.
Here's the fix. I'm assuming you have AD CS (Active Directory Certificate Services) in your environment. If you're running a CA, these steps will get you back up in minutes.
- Identify which DCs have expired certificates. Open PowerShell as an admin on any DC or client with RSAT tools and run:
Get-ADDomainController -Filter * | ForEach-Object {
$dc = $_.HostName
$cert = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -like "*$dc*" -and $_.EnhancedKeyUsageList -contains "KDC Authentication" }
if ($cert) {
[PSCustomObject]@{ DC = $dc; Expiration = $cert.NotAfter }
}
}
Look for any expiration date in the past. That's your culprit.
- Renew or request a new certificate. The easiest way is to use the
certreqtool. On the affected DC, run:
certreq -new -q -certtemplate "DomainControllerAuthentication" -machine myDCName.contoso.comReplace the template name with what you use — standard is DomainControllerAuthentication or KerberosAuthentication. If you're not sure, check your CA's template list. The command will prompt for a file to save the request. Then submit it:
certreq -submit -attrib "CertificateTemplate:DomainControllerAuthentication" request.reqThat returns a request ID. Then install the issued certificate:
certreq -accept certnew.cerMake sure you run these as an account with rights to enroll certs for the DCs.
- Verify the new cert is in place. Check the cert's validity and EKU:
Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -match "yourDC" -and $_.EnhancedKeyUsageList -match "KDC" } | Select-Object Subject, NotAfterYou want to see a future expiration date and the KDC Authentication EKU. If the EKU doesn't show up, you've enrolled the wrong template.
- Clear the Kerberos ticket cache on the DC. Sometimes old tickets linger. Use:
klist -li 0x3e7 purgeThat's the local system account. It wipes any stale tickets that might reference the old cert.
- Restart the Kerberos Key Distribution Center service. It's tempting to reboot the whole DC, but a service restart is enough. Run:
Restart-Service -Name KDC -ForceWait a few seconds, then test with a smart card from a client. If you can log in, you're done.
If it still fails
Don't panic. The cert might be renewed but the old one is still cached on the client. Run klist purge on the client machine as the user who's logging in, then retry. Also check that the DC's certificate is actually linked to the root CA that clients trust. If you have a two-tier PKI, make sure the intermediate CA cert is in the NTAuth store on all DCs — that's a common gotcha.
Another thing: verify the certificate template has the right EKU. The DomainControllerAuthentication template includes the Kerberos Authentication EKU by default, but if someone modified it, your cert won't have it. You can check the EKU with:
certutil -store My \"dcName\" | findstr /i \"KDC\"If you see "KDC Authentication" or "1.3.6.1.5.2.3.5", you're good. If not, re-enroll with a correct template.
Finally, if you're in a cross-forest scenario, make sure the trusted DC's cert is also in the NTAuth store of the trusting forest. That's rare, but I've seen it break more than once.
One more tip: set up auto-enrollment for DC certificates so this doesn't happen again. Use a GPO to enable certificate auto-enrollment for the computer account, and make sure the cert template allows auto-enrollment. Then set a renewal period of at least 2 weeks before expiry. It'll save you a late-night call.