Okta Advanced Server Access (ASA) Passwordless Remote Desktop Protocol (RDP) fails with the following error.

The encryption type requested is not supported by the KDC.

RDP through ASA AD-joined works with a password.

• Okta Advanced Server Access (ASA) Active Directory (AD) Joined 
• Passwordless Remote Desktop Protocol (RDP)
• Group Policy Object (GPO)

This can happen when the GPO setting Computer configuration > Policies > Windows Settings > Security Settings > Local Policies/Security Options > Network security: configure encryption types allowed for Kerberos is not set to Not Defined, and the needed encryption types are not selected.

Also, if the Local setting is defined, then it overrides the global GPO of Not Defined.

Make sure both local and global GPO Network security: configure encryption types allowed for Kerberos are set to Not Defined.

OR

Both should have the same settings with AES128, AES256, and future encryption types enabled.