Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

According to some of the documentation I've read the service account for SQL server will create an SPN when the database engine starts up, allowing for kerberos authentication. I haven't been able to find any documentation that states what permission an account would need to create an SPN. So, what permissions would an account need to have (barring domain admin if that's possible) in order to create an SPN?

share|improve this question

Based on this MSDN article, and clarification by @Handyman5, the section "Delegating Authority to Modify SPNs" states

If you need to allow delegated administrators to configure service principal names (SPNs), you must ensure that their user accounts have the Validated write to service principle name permission.

The permission to delegate "Validated write to service principle name" requires "Membership in Domain Admins, or equivalent"

share|improve this answer
Not necessarily; the link you gave mentions that all you need is to have the "Validated write to service principle name" permission delegated to your account or group. OP could create a group for "Keytab Admins" and delegate this permission only to it without needing to make everybody Domain Admins. – Handyman5 Nov 18 '11 at 7:01
Ah, so the line "Membership in Domain Admins, or equivalent, is the minimum required to complete this procedure" means domain admin power is required to delegate that power but the only required privilege is the ability write to spn you've indicated? – billinkc Nov 18 '11 at 12:55
Yes, that's correct. – Handyman5 Nov 18 '11 at 19:00
Here's a nice blog post which describes how to create an AD group which has the permissions:… – Mark Iannucci Aug 12 '15 at 13:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.