Windows Server 2025 | Kerberos Local Key Distribution Center (LocalKDC) service fails to start

Krasimir Rangelov 210

Hello,

After installing the latest cumulative update for December, KB5048667, on my Windows Server 2025 system, the Kerberos Local Key Distribution Center (LocalKDC) service fails to start due to the following generic exception:

"Some services stop automatically if they are not in use by other services or programs."

This issue appears to be related to the recent changes regarding NTLM deprecation and the optional shift to Kerberos for local user authentication.

After uninstalling the cumulative update for December, the service gets stuck at START_PENDING and never starts, that gives me some chills.

Cannot find any events regarding the Local KDC service, even after enabling logging for Microsoft-Windows-Kerberos-Local-Key-Distribution-Center/Operational.

Given the importance of these changes, I’d like to report this as a potential issue with the latest GA implementation.

Is this a known issue with KB5048667?

Ian Wall 0 Reputation points

2024-12-31T00:26:56.06+00:00

Apologies, this was meant as a response to the answer.
Ahmed Alsayed Ibrahim 0 Reputation points

2025-01-05T14:43:40.5+00:00

i have same issue, and now Windows Hello for Business Cloud Kerberos stop working
O HICKMOTT 10 Reputation points

2025-01-08T14:29:04.28+00:00

Same for us also, including broken WHfB cloud trust
Nicolas Lavisse 10 Reputation points

2025-01-13T13:10:33.93+00:00

I have the same problem on a 2025 that has just been installed and the installation of updates...
Nicolas Lavisse 10 Reputation points

2025-01-13T13:15:38.9666667+00:00

I have the same problem on a 2025 that has just been installed and the installation of updates...
Nicolas Lavisse 10 Reputation points

2025-01-13T14:50:07.46+00:00

Uninstall KB5048667... and Uuable to login and black screen...

Pfff ...
O HICKMOTT 10 Reputation points

2025-01-15T13:18:19.41+00:00

2025-01 Cumulative Update makes no difference on 24H2 client or server. Nor does making the required KDC Strong Cert binding changes suggested in KB5014754.

We have this behaviour now on more than 2k client devices and have had to remove Windows Hello for Business across our estate.
David Hoeft 11 Reputation points

2025-01-17T15:51:05.6466667+00:00

Same trouble here. Have not found a solution.
Koopman 1 Reputation point

2025-01-18T00:08:50.0633333+00:00

After upgrading I cannot sign in unless I turn that service OFF!! 2025 is extremely buggy and had costs me 2 broken sites now. Rebuilding back to 2022 :(
Nicolas Lavisse 10 Reputation points

2025-01-18T15:43:42.2233333+00:00

I do that and everything works fine !

https://batcmd.com/windows/11/services/localkdc/
O HICKMOTT 10 Reputation points

2025-01-29T15:41:56.7433333+00:00

I think the bigger picture is being missed here - this is an issue that is present in both 24h2 server and client. It's one thing have your DC's unable to leverage Kerberos but the issue is compounded when all your client devices also cannot leverage it. Especially where Microsoft has now deprecated RPC and NTLM in favour of Kerberos. Which is great unless the very services that allows this auth process is broken and won't start.
tfc 15 Reputation points

2025-01-29T18:05:49.7166667+00:00

@O HICKMOTT Agree with your technical assessment of the issue but I think the bigger picture is that we are being ignored by Microsoft but that's nothing new...
Michael B Allen 0 Reputation points

2025-02-05T01:22:13.0433333+00:00

LocalKDC is just not enabled yet. Allegedly it will be in a few months. Presumably with IAKerb.

For now, NTLM is still very much required for clients that can't get tickets.

@O HICKMOTT RPC is not deprecated. RPC over HTTP transport (ncacn_http) is deprecated but other transports like RPC over TCP (ncacn_tcp_ip) and RPC over SMB (ncacn_np) are still used extensively on prem.
O HICKMOTT 10 Reputation points

2025-02-05T07:48:50.4366667+00:00

Thanks for the info @Michael B Allen please could you advise on your thoughts as to why it was enabled prior to the November CU and why WuFB no longer functions post this update?
Michael B Allen 0 Reputation points

2025-02-05T13:00:00.98+00:00

@O HICKMOTT Please correct me but my understanding is that Local KDC has never been enabled. My guess is that using Local KDC will require a client to use IAKerb which is not available yet. And until clients can do IAKerb, they can't "disable" NTLM. So, it seems we're waiting on IAKerb I think.

I think maybe all of the announcements about disabling NTLM and introducing Local KDC / IAKerb were meant to motivate and placate certain folks. But these things always take twice as long as you think so ... just chill.
tfc 15 Reputation points

2025-02-08T21:10:36.74+00:00

@Michael B Allen if true then it is still a bug that MS is not acknowledging. After the last patches they mysteriously set the service to Automatic startup but as we all can attest it does not start which results in a event log failures. They should acknowledge their error and publish a KB article telling us to disregard the error and set the service to manual. As usual they continue to release buggy updates and not address the issues that arise from them.
Mela Germier 96 Reputation points

2025-02-13T10:27:38.1733333+00:00

OS build: 26100.3194

And The Problem persist...

It's unbelievable how bad Microsoft support has become these days.

Here another issue where we are Fighting with Microsoft..... interesting for this who is as ADDS (https://techcommunity.microsoft.com/discussions/WindowsServerInsiders/when-is-network-profile-issue-for-domain-controllers-going-to-be-at-least-acknow/4156679)
Paul 0 Reputation points

2025-02-15T20:28:38.66+00:00

Exact same Service Status report here on all 2025 member servers. DC's still on 2022

I found this video very useful https://youtu.be/nJ3gGNv8aZI

LocalKDC overview at time point 13.05 so from what I can ascertain this service that is reporting as not started should have no impact on your current DC/Client Kerberos setup and is a new additional Kerberos Implementation between local clients and workgroups to eliminate NTLM auths. Just my interpretation so I would reccomend watching the video and coming to your own conclusions

One of three on this blog and worth a watch https://techcommunity.microsoft.com/blog/windowsosplatform/active-directory-improvements-in-windows-server-2025/4202383

2 answers

Mobyx 5 Reputation points

2025-01-18T14:57:47.8733333+00:00

I have found that this service was disabled before the December update, for some reason it has gone to automatic and cannot be started, maybe this behavior is normal if you are not using this feature. After the January security patch the service still does not start, I think microsoft should report this problem.
Please sign in to rate this answer.

1 person found this answer helpful.
Randy Smith 0 Reputation points

2025-01-28T19:04:28.2433333+00:00

I have seen this on all Server 2025 servers I have after both the December and January updates. Rolling back to November updates fixes it.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Hania Lian 21,196 Reputation points Microsoft Vendor

2024-12-24T02:11:10.0333333+00:00

Hello,

Based on the information available, there are no officially documented issues specifically related to the Kerberos Local Key Distribution Center (LocalKDC) service in the KB5048667 update

https://support.microsoft.com/en-us/topic/december-10-2024-kb5048667-os-build-26100-2605-eb529853-d3a2-4c8d-bd0b-5fc6becb629c

You can send feedback to Microsoft by referring to this link:

https://support.microsoft.com/en-us/windows/send-feedback-to-microsoft-with-the-feedback-hub-app-f59187f8-8739-22d6-ba93-f66612949332

Best Regards,

Hania Lian

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Please sign in to rate this answer.
Ian Wall 0 Reputation points

2024-12-31T00:27:24.5933333+00:00

There may be no documented issues, but there are a decent number of people experiencing the issue. Please search Google for KB5048667 NTLM errors.

Wojciech 0 Reputation points

2025-01-02T12:05:29.5666667+00:00

Hello,

Issue exist for sure.
After clean installation and updates, new win 2025 server has the same problem.

tfc 15 Reputation points

2025-01-04T22:57:22.2266667+00:00

Dear Hania Lian- I can confirm the issue is real. Please stop gaslighting us and get the developers to fix it ASAP.

Michael Ryan 6 Reputation points

2025-01-06T02:47:58.38+00:00

Just saw this after patching, removed the update and the ADFS server was back. Hopefully we will see a fix soon.

Michael Ryan 6 Reputation points

2025-01-06T03:39:56.51+00:00

Same issue, I've just uninstalled the update and the ADFS server has returned as expected. Hopefully a proper fix soon.

STANWICK, JERALD 25 Reputation points

2025-01-09T14:35:51.5866667+00:00

Having the same issue, seems a growing issue Microsoft needs to address and fix

Ahmed Alsayed Ibrahim 0 Reputation points

2025-01-10T02:38:06.4266667+00:00

i have same issue, and now Windows Hello for Business Cloud Trust stop working.

tfc 15 Reputation points

2025-01-18T01:29:14.73+00:00

Microsoft ARE YOU LISTNEING YET!?!?!? Everyone is saying the same thing, you broke server 2025 with another botched update and you're ignoring your sys admins cries for help (as usual). FIX IT ASAP
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Windows Server 2025 | Kerberos Local Key Distribution Center (LocalKDC) service fails to start

2 answers

Your answer