WinRM-HTTTP with Kerberos Server Monitoring fails with useridd log "krb5 error 16: Device or resource busy"

WinRM-HTTP is configured with Kerberos authentication

All the server monitors show: Kerberos error

System Log shows: Server monitor <server name>: connection failed, Kerberos error

Firewall is not able to learn IP-User Mappings

PAN-OS

PANW Agentless User-ID

WinRM HTTP with Kerberos Authentication

The useridd.log shows that the firewall was not able to get the Kerberos ticket due to an error "failed to get krb5 tgt ticket with error 16." or "krb5 error 16: Device or resource busy.". Therefore, it's not able to prepare WinRM connection to the server 

2026-06-18 08:53:38.489 -0700 krb5 config:
[libdefaults]
         default_realm = EXAMPLE.DOMAIN
         dns_lookup_realm = true
         dns_lookup_kdc = true
         rdns = false
         dns_canonicalize_hostname = false
         default_tkt_enctypes = aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96
         default_tgs_enctypes = aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96
         forwardable = true
[realms]
         EXAMPLE.DOMAIN = {
                 kdc = dc01.example.domain
                 kdc = dc02.example.domain
         }
2026-06-18 08:53:56.550 -0700 Error:  pan_user_id_krb5_init_ticket(pan_user_id_win.c:2079): failed to get krb5 tgt ticket with error 16.
2026-06-18 08:53:56.550 -0700 Error:  pan_user_id_krb5_init_ticket(pan_user_id_win.c:2084): krb5: accout=PaloAltoFW, domain=EXAMPLE.DOMAIN, principal=PaloAltoFW@EXAMPLE.DOMAIN, cached file=/opt/pancfg/.userid/krb5_cache_1_servermon-dc01.example.domain_1781723180.
2026-06-18 08:53:56.550 -0700 Error:  pan_user_id_krb5_init_ticket(pan_user_id_win.c:2110): krb5 error 16: Device or resource busy.
2026-06-18 08:53:56.550 -0700 Warning:  pan_user_id_krb5_set(pan_user_id_win.c:2198): failed to acquire krb5 tgt ticket on vsys 1 for server servermon-dc01.example.domain.
2026-06-18 08:53:56.550 -0700 Error:  pan_user_id_winrm_query(pan_user_id_win.c:2764): failed to prepare winrm connection in vsys 1, server=servermon-dc01.example.domain

Note, the firewall is configured with two servers (dc01.example.domain & dc02.example.domain) in the Kerberos server profile. When we verified the reachability of both, the dc01.example.domain was not reachable over the network.

When multiple KDC are configured in the Kerberos server profile, make sure all of them are reachable. If one of them is not reachable, either fix the server reachability or remove it from the Kerberos server profile.

For example, in the above scenario dc01.example.domain was not resolving and also it was not reachable from the firewall through IP address.

> ping host dc01.example.domain
ping: dc01.example.domain: System error

> ping host 10.10.10.1
PING 10.1.1.1 (10.1.1.1) 56(84) bytes of data.
^C
--- 10.1.1.1 ping statistics ---
6 packets transmitted, 0 received, 100% packet loss, time 102ms

To fix the above issue, we removed the dc01.example.domain from the Kerberos server profile and committed the changes.

After the successful commit, the useridd.log should show the corrected configuration without the kdc=dc01.example.domain in krb5 config like below. If it does not show, restart the useridd process with the command > debug software restart process user-id

2026-06-18 08:53:38.489 -0700 krb5 config:
[libdefaults]
         default_realm = EXAMPLE.DOMAIN
         dns_lookup_realm = true
         dns_lookup_kdc = true
         rdns = false
         dns_canonicalize_hostname = false
         default_tkt_enctypes = aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96
         default_tgs_enctypes = aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96
         forwardable = true
[realms]
         EXAMPLE.DOMAIN = {
                 kdc = dc02.example.domain
         }

Check the server monitor status and all of them should be in the connected state