> I looked for that and couldn't find it.
I may have found it! The 1.5.X KDC has a mile long function
_kdc_as_rep() which in the middle somewhere has
e_text = "No ENC-TS found";
That function looks quite different in 7.X....
> So, to reproduce just mark a principal as expired and try to kinit?
Yes. Your newer KDC may fill in something else in the
context->error_string or context->error_code compared to the return
value. So if you put a breakpoint at krb5_get_error_message and
compare these with the variable "code" which should be -1765328383.