Naturally, I turned on RC4, so there would be consistency between the two machines, and I found myself with a new error in the event log: KDC_ERR_PREAUTH_REQUIRED - this leads me to believe that the encryption methods are now working in conjunction with each other. This led me to investigate the encryption methods used between the two machines, Windows 7 has RC4, AES128/256 enabled, and Windows 10 has only AES128/256 and 'future types' enabled. Today, I did more reading and enabled the kerberos debugging registry key, and after attempting to add again, the DC returned KDC_ERR_ETYPE_NOTSUPP.

I've gone directly to our CA server on the domain and obtained the root certificates, along with CRLs that I didn't have, but the error remains the same. My understand is that this specific OID is for server authentication, and the root and CA certificates I have added to the computer account all have the proper purposes assigned to them. When using Windows Server Certificate Services create a certificated based on the Kerberos Authentication Template. The domain administrator will need to obtain a certificate with the KDC EKU for the domain controller to resolve this error. The KDC certificate for the domain controller does not contain the KDC Extended Key Usage (EKU): 1.3.6.1.5.2.3.5: Error Code 0xc0000320. They add without issue using a username/password (without 2FA), but with a smart card, I recieve the following error: I've mirrored my entire process from 7 to 10, including all missing certificates (we use netdom to add via command line, with /securepasswordprompt), but no matter what I do, my computers will not join the domain with a smart card. With Windows 10, however, this has been a nightmare. I wasn't in charge of setting it up completely on Windows 7, so I'm not sure about the inner workings of the entire Kerberos process. This was an issue for Windows 7, however, it was easy to fix by building a certificate trust chain.

My Windows 'domain-centric' company has abruptly decided to make the switch from Windows 7 to Windows 10, and it has become my job to make their prepared image join our domain with our smart card/token based authentication system.

Install netdom windows 10