Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My domain does not have a SPN for CIFS/mydomain.com. My DC is throwing ErrorCode: KDC_ERR_S_PRINCIPAL_UNKNOWN. There are a number of windows workstations on the domain that are trying to use this SPN.

setspn -a cifs/corp.dcsgroup.com.au corp.dcsgroup.com.au FindDomainForAccount: Call to DsGetDcNameWithAccountW failed with return value 0x00000525 Unable to locate account corp.dcsgroup.com.au

What problems would this cause? Should this SPN be there by default?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

I was unaware such and SPN existed... so I checked... My domain has no such SPN, and I'm not having the problem you described either


C:>setspn -L mydomain.com
FindDomainForAccount: Call to DsGetDcNameWithAccountW failed with return value 0x00000525
Could not find account mydomain.com
The command you posted attempts to ADD a new SPN. But with only the domain name, you are not providing an account name to add the SPN to. Perhaps you could tell us more about the error on the workstations. What is the full text of the error? what event number is it?

share|improve this answer
    
That is the full text of the error. According to social.technet.microsoft.com/wiki/contents/articles/… the account name can be the domain name for services that are used domain wide. –  Ablue Aug 13 '12 at 23:18
    
I imagine that accessing //mydomain.com/netlogon using kerberos would require cifs/mydomain.com SPN; but without it the negotiate service will fallback to NTLM. –  Ablue Aug 13 '12 at 23:20
    
Thats a rather long article, and I can't find a section that talks about the domain itself having a SPN. It DOES talk about each DC having it's own SPN. When you browse \\mydomain.com\netlogon, you're getting a DFS referral to a specific DC, and it's probably then that the SPN comes into play. What does SETSPN -L say for each DC you have? What OS are these DC's? Are you getting event 11 from here support.microsoft.com/kb/321044 ? Are you getting event 1645 from here support.microsoft.com/kb/308111 ? –  Craig620 Aug 14 '12 at 13:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.