Windows Server 2022 – AD replication shows KRB_AP_ERR_MODIFIED after VM restore – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Domain controllers fail replication with Kerberos errors, causing stale directory data and authentication anomalies.

Environment & Reproduction

Appears after restoring snapshots or cloned DCs without proper safeguards. Reproduce by attempting inter-site replication.

repadmin /replsummary
repadmin /showrepl

Root Cause Analysis

Machine account password/SPN mismatch causes Kerberos ticket decryption failure (KRB_AP_ERR_MODIFIED).

Quick Triage

Identify affected source/destination DC and confirm secure channel integrity.

nltest /sc_verify:
setspn -Q */

Step-by-Step Diagnosis

Audit SPNs, duplicate entries, and recent VM restore operations.

setspn -X
Get-WinEvent -LogName System -MaxEvents 200 | ? {$_.Message -match 'KRB_AP_ERR_MODIFIED|Kerberos'}

Solution – Primary Fix

Reset computer account password for affected DC and refresh Kerberos tickets.

netdom resetpwd /server: /userd: /passwordd:*
klist purge
repadmin /syncall /AdeP

Solution – Alternative Approaches

Remove duplicate SPNs and restart KDC service if ticket cache corruption persists.

setspn -D  
Restart-Service KDC

Verification & Acceptance Criteria

Replication completes without Kerberos errors and all naming contexts are current.

repadmin /showrepl
repadmin /queue
dcdiag /test:replications

Rollback Plan

If reset causes broader auth failures, restore system state for affected DC and isolate it from replication mesh until repaired.

Prevention & Hardening

Disable unsupported VM snapshot workflows for DCs and enforce AD-safe backup/restore procedures.

Related Errors & Cross-Refs

Correlates with USN rollback risks, duplicate SID issues, and lingering object cleanup operations.

View all Windows Server 2022 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Learn: AD replication troubleshooting, KRB_AP_ERR_MODIFIED handling, and DC virtualization safeguards.