Question: how to check kvno in ad?
Answer: Run "klist -k" to see the key version number (kvno) in the default key table (/etc/krb5. keytab). ... 
Get credentials for some Kerberos user. # kinit <user>
List credentials to verify they exists. # klist. ... 
Get key version number from the KDC.