diff --git a/tests/kdc/Makefile.am b/tests/kdc/Makefile.am
index 6ac63a2b9..4fce8d143 100644
--- a/tests/kdc/Makefile.am
+++ b/tests/kdc/Makefile.am
@@ -4,7 +4,7 @@ include $(top_srcdir)/Makefile.am.common
 
 noinst_DATA = \
 	krb5.conf \
-	krb5-no-weak.conf \
+	krb5-weak.conf \
 	krb5-pkinit.conf \
 	krb5-pkinit-win.conf \
 	krb5-slave.conf
@@ -18,6 +18,7 @@ SCRIPT_TESTS = \
 	check-digest \
 	check-kadmin \
 	check-kdc \
+	check-kdc-weak \
 	check-keys \
 	check-kpasswdd \
 	check-pkinit \
@@ -57,16 +58,25 @@ check-delegation: check-delegation.in Makefile
 	chmod +x check-delegation.tmp
 	mv check-delegation.tmp check-delegation
 
-check-des: check-des.in Makefile krb5-no-weak.conf
+check-des: check-des.in Makefile krb5.conf
 	$(do_subst) < $(srcdir)/check-des.in > check-des.tmp
 	chmod +x check-des.tmp
 	mv check-des.tmp check-des
 
 check-kdc: check-kdc.in Makefile
-	$(do_subst) < $(srcdir)/check-kdc.in > check-kdc.tmp
+	$(do_subst) \
+	   -e 's,[@]KDCCONF[@],krb5.conf,g' \
+	   < $(srcdir)/check-kdc.in > check-kdc.tmp
 	chmod +x check-kdc.tmp
 	mv check-kdc.tmp check-kdc
 
+check-kdc-weak: check-kdc.in Makefile
+	$(do_subst) \
+	   -e 's,[@]KDCCONF[@],krb5-weak.conf,g' \
+	   < $(srcdir)/check-kdc.in > check-kdc-weak.tmp
+	chmod +x check-kdc-weak.tmp
+	mv check-kdc-weak.tmp check-kdc-weak
+
 check-keys: check-keys.in Makefile
 	$(do_subst) < $(srcdir)/check-keys.in > check-keys.tmp
 	chmod +x check-keys.tmp
@@ -109,19 +119,22 @@ check-kpasswdd: check-kpasswdd.in Makefile
 
 krb5.conf: krb5.conf.in Makefile
 	$(do_subst) \
-	   -e 's,[@]WEAK[@],true,g' \
+	   -e 's,[@]WEAK[@],false,g' \
+	   -e 's,[@]dk[@],,g' \
 	   -e 's,[@]kdc[@],,g' < $(srcdir)/krb5.conf.in > krb5.conf.tmp
 	mv krb5.conf.tmp krb5.conf
 
-krb5-no-weak.conf: krb5.conf.in Makefile
+krb5-weak.conf: krb5.conf.in Makefile
 	$(do_subst) \
-	   -e 's,[@]WEAK[@],false,g' \
-	   -e 's,[@]kdc[@],,g' < $(srcdir)/krb5.conf.in > krb5-no-weak.conf.tmp
-	mv krb5-no-weak.conf.tmp krb5-no-weak.conf
+	   -e 's,[@]WEAK[@],true,g' \
+	   -e 's,[@]dk[@],default_keys = aes256-cts-hmac-sha1-96:pw-salt arcfour-hmac-md5:pw-salt des3-cbc-sha1:pw-salt des:pw-salt,g' \
+	   -e 's,[@]kdc[@],,g' < $(srcdir)/krb5.conf.in > krb5-weak.conf.tmp
+	mv krb5-weak.conf.tmp krb5-weak.conf
 
 krb5-slave.conf: krb5.conf.in Makefile
 	$(do_subst) \
 	   -e 's,[@]WEAK[@],true,g' \
+	   -e 's,[@]dk[@],,g' \
 	   -e 's,[@]kdc[@],.slave,g' < $(srcdir)/krb5.conf.in > krb5-slave.conf.tmp
 	mv krb5-slave.conf.tmp krb5-slave.conf
 
@@ -147,7 +160,7 @@ CLEANFILES= \
 	digest-reply \
 	foopassword \
 	krb5.conf \
-	krb5-no-weak.conf \
+	krb5-weak.conf \
 	krb5.conf.keys \
 	krb5-cc.conf \
 	krb5-slave.conf \
@@ -184,6 +197,7 @@ EXTRA_DIST = \
 	check-iprop.in \
 	check-kadmin.in \
 	check-kdc.in \
+	check-kdc-weak.in \
 	check-keys.in \
 	check-kpasswdd.in \
 	check-pkinit.in \
diff --git a/tests/kdc/check-des.in b/tests/kdc/check-des.in
index f995f6ab7..47a9d3f96 100644
--- a/tests/kdc/check-des.in
+++ b/tests/kdc/check-des.in
@@ -60,7 +60,7 @@ klist="${TESTS_ENVIRONMENT} ../../kuser/klist -c $cache"
 kgetcred="${TESTS_ENVIRONMENT} ../../kuser/kgetcred -c $cache"
 kdestroy="${TESTS_ENVIRONMENT} ../../kuser/kdestroy -c $cache --no-unlog"
 
-KRB5_CONFIG="${objdir}/krb5-no-weak.conf"
+KRB5_CONFIG="${objdir}/krb5.conf"
 export KRB5_CONFIG
 
 rm -f ${keytabfile}
diff --git a/tests/kdc/check-kdc.in b/tests/kdc/check-kdc.in
index 631e13bf6..cc8e2ac5e 100644
--- a/tests/kdc/check-kdc.in
+++ b/tests/kdc/check-kdc.in
@@ -79,7 +79,7 @@ kimpersonate="${TESTS_ENVIRONMENT} ../../kuser/kimpersonate -k ${keytab} --ccach
 test_renew="${TESTS_ENVIRONMENT} ../../lib/krb5/test_renew"
 test_ap_req="${TESTS_ENVIRONMENT} ../../lib/krb5/test_ap-req"
 
-KRB5_CONFIG="${objdir}/krb5.conf"
+KRB5_CONFIG="${objdir}/@KDCCONF@"
 export KRB5_CONFIG
 
 rm -f ${keytabfile}
diff --git a/tests/kdc/krb5.conf.in b/tests/kdc/krb5.conf.in
index a681e48c9..3529ed9d6 100644
--- a/tests/kdc/krb5.conf.in
+++ b/tests/kdc/krb5.conf.in
@@ -68,6 +68,7 @@
 
 [kadmin]
 	save-password = true
+	@dk@
 
 [capaths]
 	TEST.H5L.SE = {