By having a single master copy to which updates must be made, Kerberos
still has a single point of failure.
• Fortunately, Kerberos is designed so that most operations and all critical
operations are read-only operations of the KDC database.
• It's true that if the master is down, administrators can't add and delete
users, and users can't change their passwords. These operations can wait
for a few hours until the master copy is repaired.
• In contrast, the read-only KDC operations are required for any use of the
network. If there were only a single KDC, and it was unavailable, none of
the network users would be able to get any (computer-related) work
done