The Microsoft Key Distribution Service is not starting on my DC (kdssvc.dll) and when I look at the event log under Microsoft\Kdssvc, I see the events:

Event ID 4001 Group Key Distribution Service failed to start. Status 0x80070020.

Event ID 4007
Group Key Distribution Service cannot connect to the domain controller on local host. Status 0x80070020. Group Key Distribution Service cannot be started because of the error. Please contact administrators to resolve the issue.

The error 0x80070020 indicates a file lock of some type.

Does anyone know how I can fix this error? Troubleshooting on the net for this is a bit sparse and is confused with the KDC.

For clarification: This question is not about Kerberos, instead it's about the service account that handles Group Managed Service Accounts (gMSA), Bitlocker, and Windows Activation Services in a corporate environment.

Try disabling all the software running on the DC, especially the security software like the antivirus, and try again.

If you think that troubleshooting this might take a long time and is not worth to do then, assuming you have another DC/DNS/GC server, you can consider doing the following:

• Re-install the faulty DC
• Seize FSMO roles that the faulty DC was holding on another DC. You can use netdom query fsmo to get the list of fsmo hoders
• Do a metadata cleanup: Use dsa.msc and remove the faulty DC computer account then use dssite.msc and remove the faulty DC NTDS settings and its reference there
• Promote the server you re-installed as a domain controller

0x80070020 = ERROR_SHARING_VIOLATION

can you check the permission of that account and status of the account.

Hi, 
 
How is it going? Please let us know if you would like further assistance.
 
Thanks,
 

Regards,

Eth

I don't think this is a complete answer because the KDC needs to be moved to another server.  Are you familliar with this?

It's a system account - NA

The error 0x80070020 indicates a file lock of some type.

--- Try to run procmon when start the service and look for which file causes it.

the KDC needs to be moved to another server.

----Key Distribution Center (KDC) is a network service that supplies session tickets and temporary session keys to users and computers within an Active Directory domain.

The KDC runs on each domain controller as part of Active Directory Domain Services (AD DS). So I'd agree with Ahmed MALEK, the quickes way is to reinstall the faulty DC.

any update?