KDC_ERR_PADATA_TYPE_NOSUPP(KDC has no support for padata type) [Need Urgent Help] about certipy

[Prepouce]

I think it will be too late but it is the domain controller that does not support PKINIT authentication (kerberos authentication with a certificate). It could be because the DC does not have an installed certificate from your ADCS component.

You can still authenticate though LDAPS (authentication through TLS) with the command: "certipy auth -ldap-shell" and then exploit RBCD.

If you want to patch this issue, you can try to enroll certificates for your domain controller, with the following commands:

certutil -addstore root \\[ADCS]\CertEnroll\[ADCS.domain.local]_[CA-name].crt
certutil -addstore CA \\[ADCS]\CertEnroll\[CA-name].crl
certutil -addstore CA \\[ADCS]\CertEnroll\[CA-name]+.crl
gpupdate /force

More information on this error: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4771