ZEN Error Codes for Kerberos
From Tech-Wiki
More actions
Historical Zscaler Enforcement Node (ZEN) Kerberos error-code reference.
Legacy / version-specific guidance
The article uses older ZEN terminology and an archived support model. Keep the codes as historical troubleshooting context and use the current Zscaler Help Portal for active deployments.
Validation status
Reviewed during the Tech-Wiki Wave 3 migration on 27 September 2026. The historical procedure is retained for engineers supporting older estates, but is not presented as the default approach for a new deployment.
Historical procedure
If Kerberos authentication fails, the ZEN displays a page with an error code. The details of the error codes are as follows:
| Error Code | Description | When It Occurs | What to do |
|---|---|---|---|
| 441000, 461000 | The user cannot be found. | The user was deleted or cannot be found in the registered domain. | Add the user. |
| 451000 | The domain does not exist. | The realm is not a registered domain on the Zscaler service. | Contact Zscaler support to add the realm as a registered domain. |
| 491000, 501000 | Invalid Kerberos token or username. | The computer time is incorrect. | Kerberos is very sensitive to clocks being in sync. Ensure that computer time is correct and it synchronizes from an NTP server. |
For more information please refer to the Zscaler article - ZEN Error Codes for Kerberos