You are currently offline, waiting for your internet to reconnect

You receive a Key Distribution Center "Event ID: 20" event message on a Windows Server 2003-based domain controller

Support for Windows Server 2003 ended on July 14, 2015

Microsoft ended support for Windows Server 2003 on July 14, 2015. This change has affected your software updates and security options. Learn what this means for you and how to stay protected.

Consider the following scenario. You are using a Microsoft Windows Server 2003-based domain controller. The domain controller is part of a domain that does not have a certification authority (CA) installed. You receive the following event message in the Event Viewer System log:

Event Type: Warning
Event Source: KDC
Event Category: None
Event ID: 20
Date: date
Time: time
User: N/A
Computer: computer name
Description: The currently selected KDC certificate was once valid, but now is invalid. No suitable replacement was found. Smartcard logon may not function correctly if this problem is not remedied. Have the system administrator check on the state of the domain's public key infrastructure. The chain status is in the error data.

This issue may occur because of invalid domain controller certificates. Domain controller certificates may become invalid if you remove a CA that was installed in the domain. After you remove the CA, the domain controller still tries to contact the CA. Therefore, you receive the error message that is mentioned in the "Symptoms" section.
To resolve this issue, remove all the invalid domain controller certificates, as follows:
  1. At a command prompt, type the following command, and then press ENTER:
    Certutil -dcinfo deleteBad
  2. At the command prompt, type exit, and then press ENTER to close the command prompt.
  3. Remove all the Key Distribution Center (KDC) "Event ID: 20" instances from the Event Viewer System log.
  4. Restart the domain controller.
For more information about related issues, click the following article numbers to view the articles in the Microsoft Knowledge Base:
887578 You receive a "Logon failure" message when you use a smart card on a Windows Server 2003-based computer
892090 Group Policy settings are not applied when a user in an external Kerberos realm logs on to a Windows XP Professional-based or to a Windows 2000 Professional-based computer in a child domain
929272 Interactive logon styles and Key Distribution Center account lookup in Windows Server 2003

Article ID: 939088 - Last Review: 07/26/2007 18:06:41 - Revision: 1.1

Microsoft Windows Server 2003, Datacenter Edition (32-bit x86), Microsoft Windows Server 2003, Enterprise Edition (32-bit x86), Microsoft Windows Server 2003, Standard Edition (32-bit x86)

  • kbexpertiseinter kbtshoot kbprb KB939088