how is kdc enabled to support for claims?
On the Group Policy Management Editor, under Computer Configuration, expand Policies, expand Administrative Templates, expand System, and select KDC. In the right pane, double-click KDC support for claims, compound authentication, and Kerberos armoring. In the new dialog window, set KDC support for claims to Enabled.