diff --git a/NEWS b/NEWS
index 039120e2eaecf1a19bd148b5bd2e73ae9d530c36..42bcf6c02d7b37ef31f4fdd03651242a0407dd10 100644
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,8 @@
 unreleased (2017-??-??)
 
+    [kerberos] Use three rather than four "kdc" lines in
+    /etc/krb5.conf. [adamhl]
+
     Starting the work to make the code Puppet 4 compatible. [adamhl]
 
     [ssh] Add $extra_gssapi_only_users parameter listing any extra
diff --git a/manifests/kerberos/krb5_conf.pp b/manifests/kerberos/krb5_conf.pp
index 6cf0c4570b50b3e2862a256320d1f7ad37956ce6..5cea1a71e8dd0a2f7b5d2921aa3d350e9162f542 100644
--- a/manifests/kerberos/krb5_conf.pp
+++ b/manifests/kerberos/krb5_conf.pp
@@ -36,7 +36,6 @@
 #           kdc            = krb5auth-<env>1.stanford.edu:88
 #           kdc            = krb5auth-<env>2.stanford.edu:88
 #           kdc            = krb5auth-<env>3.stanford.edu:88
-#           kdc            = krb5auth-<env>4.stanford.edu:88
 #           master_kdc     = master-kdc-<env>.stanford.edu:88
 #           admin_server   = krb5-admin-<env>.stanford.edu
 #           kpasswd_server = krb5-admin-<env>.stanford.edu
@@ -113,7 +112,6 @@
 #           kdc            = krb5auth-<env>1.stanford.edu:88
 #           kdc            = krb5auth-<env>2.stanford.edu:88
 #           kdc            = krb5auth-<env>3.stanford.edu:88
-#           kdc            = krb5auth-<env>4.stanford.edu:88
 #           master_kdc     = master-kdc-<env>.stanford.edu:88
 #           admin_server   = krb5-admin-<env>.stanford.edu
 #           kpasswd_server = krb5-admin-<env>.stanford.edu
@@ -128,7 +126,6 @@
 #           kdc            = krb5auth-test1.stanford.edu:88
 #           kdc            = krb5auth-test2.stanford.edu:88
 #           kdc            = krb5auth-test3.stanford.edu:88
-#           kdc            = krb5auth-test4.stanford.edu:88
 #           master_kdc     = master-kdc-test.stanford.edu:88
 #           admin_server   = krb5-admin-test.stanford.edu
 #           kpasswd_server = krb5-admin-test.stanford.edu
@@ -198,7 +195,6 @@ define base::kerberos::krb5_conf (
         "krb5auth-${env}1.stanford.edu",
         "krb5auth-${env}2.stanford.edu",
         "krb5auth-${env}3.stanford.edu",
-        "krb5auth-${env}4.stanford.edu",
       ]
       $master_kdc_actual     = "master-kdc-${env}.stanford.edu"
       $admin_server_actual   = "krb5-admin-${env}.stanford.edu"