diff --git a/library/ipajoin.py b/library/ipajoin.py
index 014ff0aa0688744ed9d8634e525db93627670d7b..dc550736f2d7eb13ac345633c02425595663dbce 100644
--- a/library/ipajoin.py
+++ b/library/ipajoin.py
@@ -332,6 +332,10 @@ def main():
             changed = True
             module.log("Enrolled in IPA realm %s" % realm)
 
+        # Fix missing krb5.keytab file for already joined host
+        if already_joined and not os.path.exists(paths.KRB5_KEYTAB):
+            module.fail_json(msg="krb5.keytab missing! Retry with ipaclient_force_join=yes to generate a new one.")
+
         start = stderr.find('Certificate subject base is: ')
         if start >= 0:
             start = start + 29