Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My domain does not have a SPN for CIFS/ My DC is throwing ErrorCode: KDC_ERR_S_PRINCIPAL_UNKNOWN. There are a number of windows workstations on the domain that are trying to use this SPN.

setspn -a cifs/ FindDomainForAccount: Call to DsGetDcNameWithAccountW failed with return value 0x00000525 Unable to locate account

What problems would this cause? Should this SPN be there by default?

share|improve this question
up vote 1 down vote accepted

I was unaware such and SPN existed... so I checked... My domain has no such SPN, and I'm not having the problem you described either

C:>setspn -L
FindDomainForAccount: Call to DsGetDcNameWithAccountW failed with return value 0x00000525
Could not find account
The command you posted attempts to ADD a new SPN. But with only the domain name, you are not providing an account name to add the SPN to. Perhaps you could tell us more about the error on the workstations. What is the full text of the error? what event number is it?

share|improve this answer
That is the full text of the error. According to… the account name can be the domain name for services that are used domain wide. – Ablue Aug 13 '12 at 23:18
I imagine that accessing // using kerberos would require cifs/ SPN; but without it the negotiate service will fallback to NTLM. – Ablue Aug 13 '12 at 23:20
Thats a rather long article, and I can't find a section that talks about the domain itself having a SPN. It DOES talk about each DC having it's own SPN. When you browse \\\netlogon, you're getting a DFS referral to a specific DC, and it's probably then that the SPN comes into play. What does SETSPN -L say for each DC you have? What OS are these DC's? Are you getting event 11 from here ? Are you getting event 1645 from here ? – Craig620 Aug 14 '12 at 13:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.