[elbutre]

hi

i have been playing with bes 5.0 on a windows 2008 x64 server hooked up to my exchange 2007 server for a while now. after 1 week i discovered that after a reboot of my bes 5.0 server i received the following kerberos error

The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server host/uk-dnsserver.domain.com. The target name used was HOST/UK-MAILBOX. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Please ensure that the target SPN is registered on, and only registered on, the account used by the server. This error can also happen when the target service is using a different password for the target service account than what the Kerberos Key Distribution Center (KDC) has for the target service account. Please ensure that the servi ce on the server and the KDC are both updated to use the current password. If the server name is not fully qualified, and the target domain (domain.COM) is different from the client domain (domain.COM), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

I opened a support case with MS as i could not find any duplicate entries. MS spend 4 weeks taking logs and spend hours on the phone. the kerberos error only happens when blackberry services are set to start automatically, if i stop and disable the bes services and reboot the error disappears.

MS confirmed that they have other clients who are also running bes 5.0 servers have similar issues, another company i know off has recently upgradede to bes 5.0 and has exactly the same issue. they are not using exchange 2007 but 2003 so it is related to bes 5.0

has anyone else experienced this issue and have you been able to find a fix as MS cannot figure out what is wrong. I am about to call BES support to see if they know what is causing this issue but thought i would check on this forum as well

many thanks

[CMerchant]

Wow what a coincidence. I too have just noticed the exact same error. The only difference is it took our servers about two months before it started showing the error.

Please let us know what you find, and if I find something I will do the same.

Thanks...

[RadHaz75]

i had this same exact error for every mailbox the bes was connecting to occurring about every hour. we r running windows 2008 r2 64bit, i rebuilt the servers using a newer image, the error occurred twice in 10 minutes immediately after installing bes and has not reappeared now for 4 days since.

no idea what they mean of if they indicate a problem.

[S4nd3r1n0]

We have exactly the same issue. We are running BES 5.0 on a windows 2003 server, connecting to an Exchange 2007 environment running on server 2008.
The Kerberos error appears a couple of times a day.
Another thing I noticed is that sometimes when I go to the MAPI profile in the BES configuration and resolve the BES service account I get an error "Name could not be resolved. Network problems are preventing you from connecting to the Exchange server." But other times this works fine.

Users however receive and send emails without any problems. there are only a few users that have some issues with syncinc contacts.

[SteveA]

I've also been experiencing this for 2 weeks and have not been able to pinpoint the sudden problem. The name resolution stops functioning which causes message delivery problems for some users. The workaround is to change my server name to its IP address and then the MAPI resolves. There haven't been any DNS changes so I'm perplexed. If anyone has working fix, please let me know.

A call to TSupport is in order. I will post my findings too.

[elbutre]

so RIM support were useless, after days of log analysing they suggested a reboot

anyway the good news is that since installing SP2 the kerberos errors have disappeared.

i have done a variety of reboots in the last week an no return of the dreaded kerberos error has reappeared.