Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

According to Setspn Overview it's discouraged to use Setspn -A to add an SPN record and it's suggested to use Setspn -S instead.

It's said that Setspn -S checks whether the SPN already exists before adding a new one. Setspn –A does not perform this check.

Although you can use Setspn -A to add an SPN, you should use Setspn -S instead because -S will verify that there are no duplicate SPNs.

However on Windows Server 2012 I see that Setspn -S and Setspn -A behave the same way: if an SPN record for an account exists then I get a failure both with -A and -S arguments.

Is there any real difference between Setspn -S and Setspn -A?

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

Not any more. You sort of answered your own question. It has obviously been decided that there's no need for the original -A functionality of not checking for duplicates any more... but you can't just go willy-nilly ripping the -A out, because someone's script somewhere that was using -A would break.

share|improve this answer
Thank you, Ryan! –  bahrep Mar 18 '13 at 14:32
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.