VNX: server_kerberos output shows incorrect or outdated information about KDC (Dell EMC Correctable)

The command "server_kerberos server_x -list" will sometimes show KDCs that have been decommissioned and are no longer in use. For example, in the output below, the server "oldserver.mouse.com" is not what the administrator expects to see listed as the current KDC for the configured realm:

[nasadmin@MoundsBar_CS0 ~]$ server_kerberos server_2 -list
server_2 : 


Kerberos common attributes section:
    Supported TGS encryption types:  rc4-hmac-md5 des-cbc-md5 des-cbc-crc
    Supported TKT encryption types:  rc4-hmac-md5 des-cbc-md5 des-cbc-crc
    Use DNS locator:                yes

Kerberos realm configuration:

realm name:           MOUSE.COM
    kdc:              oldserver.mouse.com
    admin server:     oldserver.mouse.com
    kpasswd server:   oldserver.mouse.com
    default domain:   mouse.com

This happens because KDC portion of the output from the "server_kerberos server_x -list" command is pulled from ".etc/krb5.conf" on the data mover. This portion of the content of this file is generated the first time a given CIFS server is joined to a domain, and then the data is not overwritten afterwards. Note that if the CIFS server was migrated from one platform to another, that these values could have been generated prior to when the VNX system its self was deployed into production. The more important part of the output is the "Use DNS locator" value. If this is set to yes, that means that the system is selecting a KDC based on the DNS records configured in the environment rather than the values shown in the realm configuration.

If the administrator wants to see which KDC the VNX system is actually using, the better command to use is "server_kerberos server_x -ccache".

You can also use a command like the following to manually perform a DNS lookup for the relevant records for the KDC. The domain "mouse.com" is used as a placeholder here, so the administrator will want to replace that with the FQDN of the relevant domain:

/nas/bin/.server_config server_2 -v "dns query SRV=_kerberos._tcp.mouse.com"