SMB Kerberos Not Working

#%NASL_MIN_LEVEL 80900

include("compat.inc");

if (description)
{
  script_id(242431);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/07/21");

  script_name(english:"SMB Kerberos Not Working");

  script_set_attribute(attribute:"synopsis", value:
"The scan was configured to use Kerberos for Windows authentication,
but Kerberos failed for this host..");
  script_set_attribute(attribute:"description", value:
"The scan was configured to use Kerberos for Windows authentication,
but Kerberos failed at least once for this host.  There are many
causes for Kerberos failure in a Windows environment.  They include:

  * Lack of time synchronization between the DC, scanner and target.
  * DC or targets were not specified as FQDNs in the scan policy.
  * DNS name resolution of the DC or target failed at the scanner.
  * Reverse DNS resolution of the DC or target failed at the scanner.
  * Duplicate or missing SPNs on the DC or target.
  * Misconfigured scan credentials.

Nessus attempted to use NTLM instead to preserve scan continuity.

Note regarding the see-also link:
  Nessus does not require the scanner to be registered to the
  same domain as the DC or target.  Nessus can be running on
  any platform; Windows, Linux or MacOS.");
  script_set_attribute(attribute:"solution", value:"n/a");
  script_set_attribute(attribute:"risk_factor",value:"None");
  #https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kerberos-authentication-troubleshooting-guidance
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5d208aaa");

  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/21");

  script_set_attribute(attribute:"plugin_type",value:"local");
  script_end_attributes();

  script_category(ACT_END);
  script_family(english:"Settings");

  script_copyright(english:"This script is Copyright (C) 2025 Tenable Network Security, Inc.");

  script_require_keys("SMB/kerberos_not_working");

  exit(0);
}

get_kb_item_or_exit("SMB/kerberos_not_working");

security_note(port:88);