Don't reopen the KDB in update_princ_encryption kdb5_util update_princ_encryption iterates over the KDB and writes modified entries. With the DB2 back end, the first write operation has to upgrade the lock and reopen the DB, which resets the cursor state. Take out an explicit write lock before iterating to avoid this step. https://github.com/krb5/krb5/commit/1c65092f874edc41c02f328608e2e44a93a6fb89 Author: Greg Hudson Commit: 1c65092f874edc41c02f328608e2e44a93a6fb89 Branch: master src/kadmin/dbutil/kdb5_mkey.c | 12 ++++++++++++ 1 files changed, 12 insertions(+), 0 deletions(-)