I am trying to isolate the cause of a KRB5KDC_ERR_BADOPTION (13) that I am seeing come back in a WireShark trace.
I have set an SPN to associate xxx/server.fqdn:port with the domain account that the xxx service is running under on the target server (lets call it domain\target). The server service that is will be acting as the delegate is running on a different service account (e.g. domain\delegate). Is this allowed? Or do all of the services need to be running under the same service account (i.e. the service account being used by both the target service and the middle-man service are running with the same AD service account, with appropriate SPNs set up for both services associated to that same AD service account)
