What are the main disadvantages of Kerberos?

Without the Kerberos server nobody can authenticate (single point of failure, mitigated by several KDCs); all clocks must be kept synchronised to within about 5 minutes; and if the Kerberos server is broken into, all keys are compromised.

• Single point of failure: no KDC, no new tickets, so users cannot log in or reach new services. The fix is several KDCs that replicate the database (in Windows, every domain controller is a KDC).
• Clock dependency: timestamps in authenticators and tickets only work if all machines agree on the time, typically within 5 minutes; otherwise authentication fails with a "clock skew too great" error.
• Crown jewel: the KDC knows every user's and every service's long-term key. An attacker who takes over the KDC can impersonate anyone and decrypt any ticket. KDCs must therefore be among the best-protected machines in the network.

Further practical limits: Kerberos needs every service to be "kerberised" (registered in the realm with its own key), and it is designed for one administrative domain, so cross-organisation login on the internet is usually done with SAML or OpenID Connect instead.

Go deeper:

• Kerberos drawbacks and limitations (Wikipedia) — single point of failure, time requirements and the central key store.
• RFC 4120, Section 1.6: Environmental assumptions — what Kerberos does not solve, from denial of service to weak passwords.