1
Diagnostic step 1
On a failing client, run 'klist purge' to clear Kerberos tickets, then attempt WinRM to check whether the issue is resolved temporarily; collect logs for comparison.
FULL AI ANALYSIS
WinRM/PowerShell Remoting fails with CredSSP errors after domain controller TLS cert rotation
Generated Oct 13, 2026, 9:45:52 AM
Analysis summary
Kerberos KRB_AP_ERR_MODIFIED typically indicates SPN/Service ticket validation mismatch — often caused by load-balanced DCs or multiple domain controllers presenting different service credentials or when a client resolves a service to an endpoint with a certificate/SPN mismatch. Rotating LDAPS certificates or changing load balancer TLS termination can affect client behavior if CRL/OCSP, DNS, or SPN mappings are inconsistent. Credential Delegation (CredSSP) depends on trust between client and target; certificate changes can trigger errors. Temporary fixes (purging tickets, service restarts) suggest cached tickets or resolver mapping to inconsistent endpoints.
Possible causes
Clients caching old LDAPS certificates or KDC endpoints (DNS round-robin) leading to ticket validation against unexpected host.
95%Kerberos service ticket validation failing due to DCs presenting differing credentials or SPN mismatch after load balancer TLS termination change.
90%Group Policy or CredSSP policy not propagated; some clients are not configured to allow CredSSP to updated targets.
50%Time skew between clients and DCs causing Kerberos failures amplified by reconfiguration.
10%Suggested fixes
2
Diagnostic step 2
Verify DNS and SPN mappings: ensure SRV records for KDCs are correct and clients resolve to expected domain controllers. Use 'setspn -Q' on DCs to validate SPNs for host/service names used by WinRM/LDAPS.
3
Diagnostic step 3
Check that LDAPS certificate chains on all DCs are valid and have matching subject/subjectAltNames for the service name clients use. Confirm CRL/OCSP is reachable from clients.
4
Diagnostic step 4
Audit Group Policy for CredSSP settings (Computer Configuration -> Administrative Templates -> System -> Credentials Delegation) and ensure policies are consistent across OUs; force gpupdate /force where required.
5
Diagnostic step 5
Plan a coordinated rollout: update certificates on DCs in a maintenance window, ensure all DCs present matching SPNs/cert subjects, and restart Kerberos/WinRM services across management hosts to clear cached state. Escalate to AD/PKI team if cert chain or SPN inconsistencies are discovered.