Normally when you set up Kerberos for IIS, you would do something like setspn -A HTTP/machine some_account. When IIS 7 is installed, it registers the SPN "HOST/machine" for its kernel-mode authentication. Why does this work? Is "HOST" some kind of catch-all SPN that matches when there is no protocol-specific (e.g. "HTTP") SPN registered? Because the client will still specify the HTTP SPN in its TGT requests, right?

(Sorry if this is a simple question, "HOST" is a predictably difficult term to google)

1 Answer 1


HOST is a catch all for several SPNs. These are determined by the field SPNmappings in CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=MyDC,DC=com in your AD using ADSIEdit.msc

See this site for more information The problem with duplicate SPNs – alternate working title… KB321044++

And so I don't forget:

CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=contoso,DC=com

  • Can you clarify one thing: it's legal and possible to have an SPN for one of the classes that defer to HOST registered to another account, right?
    – bmm6o
    Jul 31, 2013 at 15:25
  • 2
    Well, no. SPN's have to be unique. Period. So typically you see a web server with HTTP SPN's via HOST for the machine name, then an alias registered with the SPN HTTP/<alias>. But if you were adding an SPN for a duplicate machine, that would be bad. Aug 1, 2013 at 16:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.