What does "Client credentials have been revoked" mean?

[Richard Sharpe]

On Fri, Sep 13, 2013 at 9:40 AM, Jeremy Allison <jra at samba.org> wrote:
> On Thu, Sep 12, 2013 at 03:40:58PM -0700, Richard Sharpe wrote:
>> On Thu, Sep 12, 2013 at 2:44 PM, Jeremy Allison <jra at samba.org> wrote:
>> > On Thu, Sep 12, 2013 at 02:22:16PM -0700, Richard Sharpe wrote:
>> >> Hi folks,
>> >>
>> >> On one system, when joined to AD, after ten minutes or so, we see the following:
>> >>
>> >> libads/kerberos_util.c:101(ads_kinit_password)
>> >>
>> >>   kerberos_kinit_password some-machine$@some.domain.some-tld failed:
>> >> Clients credentials have been revoked
>> >>
>> >> What might be the cause of this? Has anyone here seen it?
>> >>
>> >> There seems to be lots of questions of this type on the web.
>> >
>> > From this page:
>> >
>> > http://technet.microsoft.com/en-us/library/bb463167.aspx
>> >
>> >  Clients’ credentials have been revoked while getting initial credentials
>> >
>> > Application/Function: kinit
>> >
>> > Potential Causes and Solution: Can indicate that the user's account is locked or expired (account expired, not password expired).
>> >
>> > Hope this helps,
>>
>> If you disable the computer account you get the same message. I wonder
>> who disabled the computer account.
>
> I don't think Samba ever does this automatically.

Yeah, I agree.

Now I have to figure out if they have some sort of policy that is
doing it or they are manually disabling the computer account or what.

-- 
Regards,
Richard Sharpe
(何以解憂？唯有杜康。--曹操)