Why does a SPN on a different host cause a server to lose its trust? How should I fix it?

Question

I have a brand new server image that loses its trust as soon as it's joined to the domain. I suspect it's because of the duplicate SPN I discovered using the LDAP version of this Powershell script

Powershell script

#Set Search
cls
$search = New-Object DirectoryServices.DirectorySearcher([ADSI]“”)
$search.filter = “(servicePrincipalName=*)”
$results = $search.Findall()



#list results
foreach($result in $results)
{
       $userEntry = $result.GetDirectoryEntry()
       Write-host "Object Name = " $userEntry.name -backgroundcolor "yellow" -foregroundcolor "black"
       Write-host "DN      =      "  $userEntry.distinguishedName
       Write-host "Object Cat. = "  $userEntry.objectCategory
       Write-host "servicePrincipalNames"
       $i=1
       foreach($SPN in $userEntry.servicePrincipalName)
       {
           Write-host "SPN(" $i ")   =      " $SPN       $i+=1
       }
       Write-host ""

} 

Host with duplicate SPN

dn: CN=NYC01IMFE02,CN=Computers,DC=hp,DC=com
changetype: add
servicePrincipalName: MSSQLSvc/NYC01IMFE02.hp.com:52407
servicePrincipalName: MSSQLSvc/NYC01IMFE02.hp.com:LYNCLOCAL
servicePrincipalName: MSSQLSvc/NYC01IMFE02.hp.com:59066
servicePrincipalName: MSSQLSvc/NYC01IMFE02.hp.com:RTCLOCAL
servicePrincipalName: http/nyc01imfe02.hp.com
servicePrincipalName: sip/nyc01imfe02.hp.com
servicePrincipalName: TERMSRV/NYC01IMFE02.hp.com
servicePrincipalName: TERMSRV/NYC01IMFE02
servicePrincipalName: WSMAN/NYC01IMFE02
servicePrincipalName: WSMAN/NYC01IMFE02.hp.com
servicePrincipalName: RestrictedKrbHost/NYC01IMFE02
servicePrincipalName: HOST/NYC01IMFE02
servicePrincipalName: RestrictedKrbHost/NYC01IMFE02.hp.com
servicePrincipalName: HOST/NYC01IMFE02.hp.com
servicePrincipalName: TERMSRV/NYC01EXCAS04
servicePrincipalName: TERMSRV/NYC01EXCAS04.hp.com
servicePrincipalName: RestrictedKrbHost/NYC01EXCAS04.hp.com
servicePrincipalName: HOST/NYC01EXCAS04.hp.com
servicePrincipalName: RestrictedKrbHost/NYC01EXCAS04
servicePrincipalName: HOST/NYC01EXCAS04

Host I just created

dn: CN=nyc01excas04,CN=Computers,DC=hp,DC=com
changetype: add
servicePrincipalName: WSMAN/NYC01EXCAS04
servicePrincipalName: WSMAN/NYC01EXCAS04.hp.com
servicePrincipalName: TERMSRV/NYC01EXCAS04
servicePrincipalName: TERMSRV/NYC01EXCAS04.hp.com
servicePrincipalName: RestrictedKrbHost/NYC01EXCAS04
servicePrincipalName: HOST/NYC01EXCAS04
servicePrincipalName: RestrictedKrbHost/NYC01EXCAS04.hp.com
servicePrincipalName: HOST/NYC01EXCAS04.hp.com

Question

1. What would cause these entries to be located on the wrong host?

.

servicePrincipalName: TERMSRV/NYC01EXCAS04
servicePrincipalName: TERMSRV/NYC01EXCAS04.hp.com
servicePrincipalName: RestrictedKrbHost/NYC01EXCAS04.hp.com
servicePrincipalName: HOST/NYC01EXCAS04.hp.com
servicePrincipalName: RestrictedKrbHost/NYC01EXCAS04
servicePrincipalName: HOST/NYC01EXCAS04

2. What is the meaning of those entries? What are they used for

3. Would they have caused a trust failure in the new machine? Why is it that only one machine has issues, and not the other

4. How do I correct the issue?

Answer 1

Basically, setspn in a proper functioning AD shows no duplicates. I think you should remove 'em at least for the troubled machine. Start with the troubled machine SPN's which miss the realm part.

Answer 2

dhcp is offering an IP address already registered in DNS to another machine. When the machine is re-joined to ActiveDirectory, the hostname is one value, but DNS server has another.

servicePrincipalName(s) are used for kerberos authentication. When an ActiveDirectory integrated application is contacting MSSQL servers, the app will probably not work correctly without those MSSQLSvc tags at least using kerberos authentication.