Yes , i think it should not occur as the reason given bby them.
The detais.
Error messages:
--------------------------
Source: KDC
Event-ID: 27
Type: Error
While processing a TGS request for the target server krbtgt/WEISHAUPT.INT, the
account WMAILDBB$@WEISHAUPT.INT did not have a suitable key for generating a
Kerberos ticket (the missing key has an ID of 8). The requested etypes were 18.
The accounts available etypes were 23 -133 -128 3 1.
Assessment
---------------------------
The problem is that the client is sending a TGS request using the Etype of 18
(AES). Windows 2003 does not support this etype for Kerberos where 2008 does. The
error that is being logged on the domain controller can safely be ignored as it is
by design. The domain controller is just informing the client what etypes it does
support. The 2008 servers are then falling back to one of the supported types. I
did find out that there is a way to modify the default etype that Windows 2008
uses. This will prevent the error from being logged on the domain controller. You
will have to add the following registry value to the Windows 2008 servers. No
reboot is required for this change to take effect. Let me know if you have any
additional questions or concerns.
Navigate to HKLM\System\CurrentControlSet\Control\LSA\Kerberos\Parameters
Add the following registry value.
Value Name = DefaultEncryptionType
Type = Reg_DWORD
Value Data = 0x17(23)
VKB: error: 27 source: KDC Windows server 2008
VKB: SRX080630601218
Windows OS Bugs 1488195
They say its OS bug.
