Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to isolate the cause of a KRB5KDC_ERR_BADOPTION (13) that I am seeing come back in a WireShark trace.

I have set an SPN to associate xxx/server.fqdn:port with the domain account that the xxx service is running under on the target server (lets call it domain\target). The server service that is will be acting as the delegate is running on a different service account (e.g. domain\delegate). Is this allowed? Or do all of the services need to be running under the same service account (i.e. the service account being used by both the target service and the middle-man service are running with the same AD service account, with appropriate SPNs set up for both services associated to that same AD service account)

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.