How to fix Error 1263 on Windows 11

by

Windows 11 Smartcard Logon Error 1263: Kerberos KDC Certificate Validation Failure

Why This Error Happens

This error occurs because the client cannot validate the Key Distribution Center (KDC) certificate presented by the Domain Controller during smartcard authentication. The most common root cause is that the Domain Controller’s certificate is missing the “KDC Authentication” (or “Smartcard Logon”) Extended Key Usage (EKU), or the client does not trust the Root Certificate Authority (CA) that issued the DC’s certificate. Additionally, a missing or incorrect Subject Alternative Name (SAN) on the DC certificate—specifically the DNS name matching the domain—can trigger this validation failure.

Step-by-Step Resolution Guide

  1. Verify the Domain Controller Certificate Template:
    Log into the Domain Controller and open the Certificates MMC snap-in (certlm.msc) targeting the “Local Computer” store. Navigate to Personal > Certificates, open the DC’s certificate, and check the “Enhanced Key Usage” field under the Details tab. Ensure it lists Kerberos Authentication or Smartcard Logon.

  2. Check for the KDC EKU (Root Cause Fix):
    If the certificate lacks the KDC EKU, you need to reissue it. On the Certificate Authority server, open certtmpl.msc, duplicate the “Kerberos Authentication” template, and ensure the Domain Controllers group has Enroll and Autoenroll permissions. Force Group Policy update on the DC (gpupdate /force) to trigger auto-enrollment of the new certificate.

  3. Update Root Certificate Trust on the Client:
    On the Windows 11 client experiencing the error, ensure the Enterprise Root CA certificate is present in the Trusted Root Certification Authorities store (Computer account, not just User). If missing, export it from the CA server and import it manually via certlm.msc, or push it via Group Policy (Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies).

  4. Validate SAN and DNS Entries:
    Confirm the DC certificate’s Subject Alternative Name (SAN) field contains the DC’s fully qualified domain name (FQDN) matching Active Directory DNS records. A mismatch here is a common cause of Event ID 1263 specifically related to name validation.

  5. Restart Services and Force Kerberos Ticket Renewal:
    Restart the KDC service on the Domain Controller (net stop kdc && net start kdc) and clear existing Kerberos tickets on the client using klist purge to force the retrieval of a new, validated ticket.

Alternative or Verification Steps

  • Verify the Fix: Check the System Event Log on the client machine (Event Viewer > Windows Logs > System) immediately after a smartcard logon attempt. If successful, Error 1263 should no longer appear, and you should see successful Kerberos ticket-granting events instead.
  • Alternative Fix: If certificate reissuance is not immediately possible, temporarily disable strict KDC validation via the registry (HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters, DWORD StrictDefaultDomain or by adjusting SCLogonEKUCheck in specific test environments) as a stop-gap—however, this is not recommended for production security environments and should only be used to isolate a certificate-specific issue.