How do I fix a non-starting "Microsoft Key Distribution Service"? (not to be confused with Kerberos KDS)

Question

The Microsoft Key Distribution Service is not starting on my DC (kdssvc.dll) and when I look at the event log under Microsoft\Kdssvc, I see the events:

Event ID 4001 Group Key Distribution Service failed to start. Status 0x80070020.

Event ID 4007
Group Key Distribution Service cannot connect to the domain controller on local host. Status 0x80070020. Group Key Distribution Service cannot be started because of the error. Please contact administrators to resolve the issue.

The error 0x80070020 indicates a file lock of some type.

Does anyone know how I can fix this error? Troubleshooting on the net for this is a bit sparse and is confused with the KDC.

For clarification: This question is not about Kerberos, instead it's about the service account that handles Group Managed Service Accounts (gMSA), Bitlocker, and Windows Activation Services in a corporate environment.

Update here is the procmon

0x80070020 = ERROR_SHARING_VIOLATION (the process cannot access the file because it is being used by another process.) run procmon while trying to start the service and look for ERROR_SHARING_VIOLATION results. Here you could see which file causes it. — magicandre1981, Aug 30 '15 at 05:30
@magicandre1981 I did it, not sure if I did it right - see above... — makerofthings7, Aug 30 '15 at 12:14
this is not the error. look for ERROR_SHARING_VIOLATION entries — magicandre1981, Aug 30 '15 at 18:07
@SamErde unfortunately, they *can* be moved out of it. This doesn't means they *should*, though. — Massimo, Sep 11 '22 at 07:49

score 0 · Answer 1 · answered Aug 13 '21 at 15:21

0

Validate that your DC is in the Default "Domain Controller" OU or the Service will fail. This is the only apparent impact of moving a DC that we experienced.

answered Aug 13 '21 at 15:21

TonyYahoo

1

How do I fix a non-starting "Microsoft Key Distribution Service"? (not to be confused with Kerberos KDS)

1 Answers1