diff --git a/libexec/rc/rc.conf b/libexec/rc/rc.conf
--- a/libexec/rc/rc.conf
+++ b/libexec/rc/rc.conf
@@ -326,7 +326,7 @@
 # kerberos. Do not run the admin daemons on slave servers
 #
 kdc_enable="NO"			# Run a kerberos 5 KDC (or NO).
-kdc_program="/usr/libexec/kdc"	# path to kerberos 5 KDC
+kdc_program=""			# path to kerberos 5 KDC
 kdc_flags=""			# Additional flags to the kerberos 5 KDC
 kdc_restart="NO"		# Auto restart kdc on abnormal termination
 kdc_restart_delay=""		# Auto restart delay seconds
diff --git a/libexec/rc/rc.d/kdc b/libexec/rc/rc.d/kdc
--- a/libexec/rc/rc.d/kdc
+++ b/libexec/rc/rc.d/kdc
@@ -20,7 +20,22 @@
 set_rcvar_obsolete kerberos5_server kdc_program
 set_rcvar_obsolete kerberos5_server_flags kdc_flags
 
+default_kdc_programs='/usr/libexec/kdc /usr/libexec/kdc /usr/libexec/krb5kdc /usr/local/sbin/krb5kdc'
+
 load_rc_config $name
+
+# XXX Remove the following block of code when Heimdal is removed
+if [ -z "${kdc_program}" ]; then
+	for i in ${default_kdc_programs}; do
+		if [ -x "${i}" ]; then
+			kdc_program=${i}
+			break
+		fi
+	done
+fi
+
+command="${kdc_program}"
+
 if [ "${kdc_program}" = /usr/libexec/kdc -o \
      "${kdc_program}" = /usr/local/libexec/kdc ]; then
 	detach="--detach"