Why kerberos keytab will not stay in sync with Active Directory kvno version

Issue

The local /etc/krb5.keytab will become outdated every 7 to 14 days. The Active Directory KDC controller will report a newer kvno number. This version number will be larger than the local system keytab kvno version. When the kvno version mismatches, the local principal is no longer valid and all attempts to use this for authentication will fail.