Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I found several references (see below) on blogs that the setspn.exe utility should be run from either a client or server machine in the domain, but not from the domain controller itself.

What is the reason for this? What happens if I run setspn.exe on the domain controller anyway? I'm asking because an SPN I set disappears after a little while.

share|improve this question

I'm not sure why they say, or said that, but I don't believe it's valid, at least not anymore, or not for the general case.

In fact, the MSDN documentation for registering an SPN for SQL Server 2014 Report Server explicitly directs you to login to a domain controller to run setspn.

share|improve this answer
Interesting, this conflicting information. Can't think of a reason why you would have to run the utility on the domain controller either. I would assume that no matter where you run the utility, the SPN gets registered in Active Directory. – MvdD Jun 4 '14 at 20:37

Possibly because of the real or imagined impact on DC performance:

... but I can't find a "this will bork AD" reason for the recommendation.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.