Ksetup: Enforce use of AES256-CTS-HMAC-SHA1-96 fails

Question

Hi,
Windows 7 Home Premium x64 authenticating to a Kerberos 5 install on Ubuntu 14.04.2.  Please note the problems are not with the latter part, several Linux clients use the Kerberos KDC without issue, and an install of "Kerberos For Windows"
with "Network Identity Manager" on the Windows 7 client works fine, but it does not integrate with the rest of the system, so...
I have used Ksetup to set the realm, add a KDC, mapped the local user to the principal, and set the machine password (principal exists in the KDC); no problems.  However, the KDC is configured to only accept AES256-CTS-HMAC-SHA1-96.
When I try the following it does not work:
C:\>ksetup /setenctypeattr REALM AES256-CTS-HMAC-SHA1-96
Setting enctypes for domain REALM to:AES256-CTS-HMAC-SHA1-96
Setting enctypes on REALM failed with 0xc0000034
Failed /SetEncTypeAttr : 0xc0000034
C:\>ksetup /addenctypeattr REALM AES256-CTS-HMAC-SHA1-96
Query of attributes on REALM failed with 0xc0000034
Failed /AddEncTypeAttr : 0xc0000034
When I perform a kinit, this is apparent (note that this is getting a response from the KDC, as using an invalid username results in a different error explicitly stating that it is invalid):
C:\>kinit username
Password for username@REALM:
Exception: krb_error 14 KDC has no support for encryption type (14) - CANT_FIND_CLIENT_KEY KDC has no support for encryption type
KrbException: KDC has no support for encryption type (14) - CANT_FIND_CLIENT_KEY
at sun.security.krb5.KrbAsRep.<init>(Unknown Source)
at sun.security.krb5.KrbAsReq.getReply(Unknown Source)
at sun.security.krb5.KrbAsReq.getReply(Unknown Source)
at sun.security.krb5.internal.tools.Kinit.sendASRequest(Unknown Source)
at sun.security.krb5.internal.tools.Kinit.<init>(Unknown Source)
at sun.security.krb5.internal.tools.Kinit.main(Unknown Source)
Caused by: KrbException: Identifier doesn't match expected value (906)
at sun.security.krb5.internal.KDCRep.init(Unknown Source)
at sun.security.krb5.internal.ASRep.init(Unknown Source)
at sun.security.krb5.internal.ASRep.<init>(Unknown Source)
... 6 more
I have already set in the Group Policy settings the value of "Network security: Configure encryption types allowed for Kerberos" to "AES256_HMAC_SHA1" only.
How can I force Windows to use the correct encryption type?
For completeness, output of ksetup below:
C:\>ksetup
default realm = REALM (external)
REALM:
kdc = kdc.server.realm
Realm Flags = 0x0No Realm Flags
Mapping username@REALM to Username.
Regards, Rob.
Edit: Just found some interesting output in the KDC logs.  These are the only entries in there for the IP address of the Win7 client.
Apr 04 11:15:23 hostname krb5kdc[1711](info): AS_REQ (4 etypes {18 17 16 23}) 10.x.x.x: CLIENT_NOT_FOUND: KERBEROS-KDC-PROBE@REALM for <unknown server>, Client not found in Kerberos database
Apr 04 11:22:24 hostname krb5kdc[1711](info): AS_REQ (4 etypes {18 17 16 23}) 10.x.x.x: CLIENT_NOT_FOUND: KERBEROS-KDC-PROBE@REALM for <unknown server>, Client not found in Kerberos database
Apr 04 11:34:02 hostname krb5kdc[1711](info): AS_REQ (5 etypes {3 1 23 16 17}) 10.x.x.x: CLIENT_NOT_FOUND: Username@REALM for <unknown server>, Client not found in Kerberos database
Apr 04 11:34:18 hostname krb5kdc[1711](info): AS_REQ (5 etypes {3 1 23 16 17}) 10.x.x.x: CANT_FIND_CLIENT_KEY: username@REALM for krbtgt/REALM@REALM, KDC has no support for encryption type
Apr 04 12:07:13 hostname krb5kdc[1711](info): AS_REQ (4 etypes {18 17 16 23}) 10.x.x.x: CLIENT_NOT_FOUND: KERBEROS-KDC-PROBE@REALM for <unknown server>, Client not found in Kerberos database
Apr 04 12:33:45 hostname krb5kdc[1711](info): AS_REQ (2 etypes {18 3}) 10.x.x.x: ISSUE: authtime 1428147225, etypes {rep=18 tkt=18 ses=18}, username@REALM for krbtgt/REALM@REALM
Apr 04 12:33:45 hostname krb5kdc[1711](info): TGS_REQ (1 etypes {18}) 10.x.x.x: BAD_ENCRYPTION_TYPE: authtime 0, username@REALM for cifs/nas.server.realm@REALM, KDC has no support for encryption type
Apr 04 12:46:17 hostname krb5kdc[1711](info): AS_REQ (5 etypes {3 1 23 16 17}) 10.x.x.x: CANT_FIND_CLIENT_KEY: username@REALM for krbtgt/REALM@REALM, KDC has no support for encryption type

Answer 1

Hi,
I'm sorry but this problem do need to be post at Windows Server forum, please access to the link below to post your question at Windows Server Forum:
https://social.technet.microsoft.com/Forums/sharepoint/en-US/home?category=windowsserver
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]