By having a single master copy to which updates must be made, Kerberos 
still has a single point of failure. 
• Fortunately, Kerberos is designed so that most operations and all critical 
operations are read-only operations of the KDC database.
• It's true that if the master is down, administrators can't add and delete 
users, and users can't change their passwords. These operations can wait 
for a few hours until the master copy is repaired. 
• In contrast, the read-only KDC operations are required for any use of the 
network. If there were only a single KDC, and it was unavailable, none of 
the network users would be able to get any (computer-related) work 
done