Fix SEC_E_NO_TGT_REPLY (0X80090334) – Kerberos Error

The 30-Second Fix: Sync Your System Clock

This is the most common reason for 0X80090334. Kerberos is picky about time. If your computer's clock is off by more than 5 minutes from the domain controller, authentication fails. You'll see this error when trying to access a network share, join a domain, or sign into an app that uses Kerberos.

1. Right-click the clock in the bottom-right corner of your screen.
2. Select "Adjust date/time".
3. Toggle "Set time automatically" to On.
4. Click "Sync now" under Synchronize your clock.
5. Wait 10 seconds. You should see "Your clock was successfully synchronized."

After syncing, try whatever you were doing again. If the error is gone, you're done. If not, move to the next step.

The 5-Minute Fix: Check DNS and Network Connectivity

Kerberos needs to talk to a domain controller (DC). If your DNS is pointing to a wrong server, you can't find the DC. This happens a lot when you move a laptop between networks, like from office Wi-Fi to home.

1. Open Command Prompt as Administrator. Click Start, type "cmd", right-click Command Prompt, pick "Run as administrator".
2. Type ipconfig /all and press Enter. Look for "DNS Servers". It should list your domain's DNS server (usually your DC's IP address).
3. If you see something like 8.8.8.8 or 192.168.1.1 (your router), that's wrong. You need the DC's DNS.
4. Type nslookup yourdomain.local (replace yourdomain.local with your actual domain name). Press Enter.
5. If it says "Non-existent domain" or returns a weird IP, your DNS is broken.
6. To fix DNS: Go to Control Panel > Network and Sharing Center > Change adapter settings. Right-click your active network adapter, pick Properties. Select "Internet Protocol Version 4 (TCP/IPv4)", click Properties. Change the DNS server to your DC's IP.
7. After changing DNS, run ipconfig /flushdns and ipconfig /registerdns in Command Prompt. You should see no errors.

Now test again. If it works, great. If not, keep going.

The 15+ Minute Fix: Reset Kerberos Tickets and Check SPN

If your clock is correct and DNS is fine, the issue might be corrupted Kerberos tickets or a missing Service Principal Name (SPN). This happens when someone changed a service account password without updating the SPN, or when the KDC (Key Distribution Center) is overloaded.

Step 1: Flush Kerberos Tickets

1. Open Command Prompt as Administrator (same as before).
2. Type klist purge and press Enter. This deletes all cached Kerberos tickets.
3. You should see "Current LogonId is 0:0x... Deleted all tickets."
4. Then run klist to verify. It should show "No entries found."

Step 2: Request a New Ticket

1. Type klist get krbtgt and press Enter. This asks for a new ticket-granting ticket.
2. If you get an error like "Failed to get ticket for krbtgt", the KDC is unreachable or the domain controller is down.
3. Check if you can ping the DC: ping yourdc.yourdomain.local. If it times out, there's a network issue.

Step 3: Verify SPN (for Service-Specific Errors)

If the error happens only with one app (like SQL Server or IIS), the SPN might be wrong or missing.

1. On the server that runs the service, open Command Prompt as Administrator.
2. Type setspn -L computername (replace computername with the server name). Press Enter.
3. Look for the SPN for the service (e.g., MSSQLSvc/servername:1433). If it's missing, you need to add it.
4. To add an SPN: setspn -A MSSQLSvc/servername:1433 domain\serviceaccount.
5. To duplicate SPNs (which also causes this error), run setspn -X on a domain controller. It'll list conflicts.

Step 4: Check Event Logs

1. Open Event Viewer (eventvwr.msc).
2. Go to Windows Logs > System. Look for errors from source "Kerberos" or "KDC".
3. Common event IDs: 11 (clock skew), 27 (bad SPN), 29 (wrong password).
4. Double-click any error. The description often says exactly what's wrong — like "The time difference is X minutes."

If none of this fixes it, you might have a firewall blocking UDP port 88 (Kerberos) or TCP port 464 (Kerberos password change). Check your firewall rules between the client and the DC.

This error rarely means your machine is broken. It's almost always time, DNS, or SPN. Run through these steps in order. Most people fix it in step one.