Active directory kerberos FAST authentication failure

Manon David 20 Reputation points
2026-09-01T08:48:25.3766667+00:00

I’m currently facing a problem where enabling Kerberos Armoring across domain controllers causes older, non‑domain‑joined devices to fail during pre‑authentication when they try to request ticket‑granting tickets (TGT). This seems to break authentication for legacy systems that don’t support FAST (Flexible Authentication Secure Tunneling).

When I check the event logs, I can see repeated pre‑auth failures pointing to unsupported encryption or missing FAST negotiation. I’ve already confirmed that the domain controllers are enforcing Kerberos Armoring through Group Policy, but I’m not sure how to make the configuration more flexible for mixed environments.

Could someone guide me on how to adjust the Domain Controller Administrative Templates to allow selective or relaxed FAST enforcement, so older clients can still authenticate while keeping newer ones protected ?

Windows for business | Windows 365 Enterprise
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-09-01T08:48:52.92+00:00

    Use a compatibility configuration instead of strict FAST enforcement.

    • On domain controllers, enable Key Distribution Center (KDC) client support for claims, compound authentication and Kerberos armoring and set Options to Always provide claims.
    • Do not configure Fail unarmored authentication requests in a mixed environment. That setting causes authentication failures for operating systems and devices that do not support Kerberos armoring.
    • On clients, leave RequireKerberosArmoring disabled or not configured unless the target domain fully supports armoring. When this policy is enabled, clients require armored AS and TGS exchanges with domain controllers, and authentication fails if the domain does not support it.
    • If client-side enforcement is needed later, first enable the Kerberos Group Policy Kerberos client support for claims, compound authentication and Kerberos armoring, then roll out RequireKerberosArmoring only to devices known to support FAST.

    For selective rollout:

    1. In Default Domain Controllers Policy, go to Computer Configuration > Administrative Templates > System > KDC.
    2. Enable Key Distribution Center (KDC) client support for claims, compound authentication and Kerberos armoring.
    3. Set Options to Always provide claims.
    4. Avoid enabling any setting that fails unarmored authentication requests while legacy or non-FAST devices still need access.
    5. If testing stricter enforcement, use an audit-only authentication policy first in Active Directory Administrative Center (ADAC) > Authentication Policies > New > Only audit policy restrictions.

    Important limitation:

    • Older or non-Windows devices that do not support the required Kerberos hardening need vendor updates or vendor support. Microsoft guidance states that non-Windows devices must support the required capabilities, and for non-Microsoft Kerberos implementations, updates or support must come from the device or app manufacturer.

    Warning:

    • Enabling strict armoring enforcement can break authentication for legacy systems.
    • Registry or policy changes that disable security hardening reduce protection and should be used only as a temporary mitigation if required.
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

    1 person found this answer helpful.
  2. Harry Phan 30,075 Reputation points Independent Advisor
    2026-09-01T11:09:21.77+00:00

    Hello Manon,

    What you are running into is expected behavior when Kerberos Armoring (FAST) is enforced domain‑wide. Legacy clients that do not support FAST cannot negotiate the tunnel and will fail pre‑authentication. Microsoft’s own documentation makes it clear: once you enforce FAST through Group Policy (Computer Configuration > Policies > Administrative Templates > System > KDC > KDC support for claims, compound authentication, and Kerberos armoring), all domain controllers will require it, and non‑compliant clients will break. There is no supported way to “partially enforce” FAST on some clients while relaxing it for others.

    The only flexible option you have is to configure the policy to “Supported” instead of “Always provide”. In practice, this means:

    If the client supports FAST, the DC will use it.

    If the client does not, authentication will still succeed without FAST.

    To adjust this, open Group Policy Management, edit the Default Domain Controllers Policy (or whichever GPO you used), and navigate to:

    Computer Configuration > Policies > Administrative Templates > System > KDC

    Set KDC support for claims, compound authentication, and Kerberos armoring to Supported. Do not set it to Always provide unless you are certain all clients in the environment support FAST.

    After updating the policy, run gpupdate /force on your domain controllers, and allow replication to complete. This will restore compatibility for older devices while still protecting newer ones that can negotiate FAST.

    If your environment requires strict FAST enforcement for compliance reasons, the only long‑term solution is to retire or upgrade those legacy systems. Microsoft does not provide a mechanism to selectively exempt certain clients from FAST once “Always provide” is enabled.

    I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

    HP.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.