Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to isolate the cause of a KRB5KDC_ERR_BADOPTION (13) that I am seeing come back in a WireShark trace.

I have set an SPN to associate xxx/server.fqdn:port with the domain account that the xxx service is running under on the target server (lets call it domain\target). The server service that is will be acting as the delegate is running on a different service account (e.g. domain\delegate). Is this allowed? Or do all of the services need to be running under the same service account (i.e. the service account being used by both the target service and the middle-man service are running with the same AD service account, with appropriate SPNs set up for both services associated to that same AD service account)

share|improve this question
add comment

1 Answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.