up vote 3 down vote favorite
share [g+] share [fb]

According to some of the documentation I've read the service account for SQL server will create an SPN when the database engine starts up, allowing for kerberos authentication. I haven't been able to find any documentation that states what permission an account would need to create an SPN. So, what permissions would an account need to have (barring domain admin if that's possible) in order to create an SPN?

link|improve this question
80% accept rate
feedback

1 Answer

up vote 4 down vote

Based on this MSDN article, and clarification by @Handyman5, the section "Delegating Authority to Modify SPNs" states

If you need to allow delegated administrators to configure service principal names (SPNs), you must ensure that their user accounts have the Validated write to service principle name permission.

The permission to delegate "Validated write to service principle name" requires "Membership in Domain Admins, or equivalent"

link|improve this answer
1  
Not necessarily; the link you gave mentions that all you need is to have the "Validated write to service principle name" permission delegated to your account or group. OP could create a group for "Keytab Admins" and delegate this permission only to it without needing to make everybody Domain Admins. – Handyman5 Nov 18 '11 at 7:01
Ah, so the line "Membership in Domain Admins, or equivalent, is the minimum required to complete this procedure" means domain admin power is required to delegate that power but the only required privilege is the ability write to spn you've indicated? – billinkc Nov 18 '11 at 12:55
Yes, that's correct. – Handyman5 Nov 18 '11 at 19:00
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.