Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to get Kerberos authentication to work with a named SQL 2008 instance. I've got it working if I connect to the instance as machine_name\instance_name. However, we have multiple A records in DNS for the same host. When I try to connect to the same instance as other_name\instance_name (where "other_name" is another A record that points to the same IP address as "machine_name"), it falls back to NTLM authentication. I've added the following SPN records:

  • MSSQLSvc/other_name:port service_account
  • MSSQLSvc/other_name:instance_name service_account
  • HOST/other_name machine_name
  • HOST/other_name.fqdn machine_name

I don't know where to go from here. Any ideas?

share|improve this question
What is the error info in your SQL Server ERRORLOG?? Can you try running your SQL Server under LocalSystem/Network Service then the SPN's are registered automatically. – Guido van Brakel Jun 5 '11 at 15:58
I'm not seeing anything in either the Windows event log or the SQL server log. I don't have the option of running under the Network Service account. – Ben Thul Jun 6 '11 at 16:16
Are TCP/IP or NP enabled in the SQL Server Protocols? See also here:… – Guido van Brakel Jun 6 '11 at 16:57
Did you register the aliased SPNs under the service account or under your account? – Remus Rusanu Jun 6 '11 at 17:52
The service account. I got good at it because I had to manually register a bunch to get Kerberos authentication working for these servers in the first place. :) – Ben Thul Jun 6 '11 at 18:35

This might be helpful: Understanding Kerberos and NTLM authentication in SQL Server Connections

share|improve this answer
That was one of the documents that I used to set up Kerberos authentication in the first place. The part that gets me is "nslookup, type the ipaddress, should get FQDN, or type FQDN should return ipaddress". FQDN->IP works, however IP->FQDN will only ever return one of the server's names. Does that mean that that you can't use Kerberos authentication with all of two or more names for a server? – Ben Thul Jun 6 '11 at 18:39

From what I've heard from AD admins in the past is that Kerberos doesn't work well with aliases. I have a feeling your best bet is to find all of the machines that reference the alias names and reconfigure them to use the machine name that is registered in Active Directory. You may be able to get lucky and drop SQL Server client network aliases on the machines that you can't figure out how to reconfigure. The client network aliases can point to the server name registered in AD and I have a feeling that will work as well. Good luck.

share|improve this answer
BTW - You're probably better off asking this question of the Active Directory gurus. I think you're problem is directly related to how Kerberos tickets are generated and handled. – Ra Osolage Jun 7 '11 at 1:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.