3

I run the setspn command for specific user on Domain Controller.

C:\>setspn -s example/username.companyname.com username
Checking domain DC=companyname,DC=com

Registering ServiceprincipalNames for CN=username,CN=Users,DC=companyname,DC=com
        example/username.companyname.com
Updated object

And immediately can see result in console.

C:\>setspn -L username
Registering ServiceprincipalNames for CN=username,CN=Users,DC=companyname,DC=com
        example/username.companyname.com

But it never affects this user in "Active Directory Users and Computers".

His attribute "servicePrincipalName" is not set.

Maybe there is some kind of cache?

1

I'm pretty sure that the reason why setspn unility does not affect "Active Directory Users and Computers" is it's old version: 6.1.

On virtual machine that I use for testing I have setspn of version 10.0 and it works perfectly.

I found that I can change SPN via Powershell.

C:\> $ReplaceHashTable = New-Object Hash-Table
C:\> $ReplaceHashTable.Add("servicePrincipalName", "example/username.companyname.com")
C:\> Set-ADUser -Identity "username" -Replace $ReplaceHashTable
C:\> Get-ADUser -Identity "username" -Properties ServicePrincipalNames

DistinguishedName     : CN=username,CN=Users,DC=companyname,DC=com
Enabled               : True
Name                  : username
ObjectClass           : user
SamAccountName        : username
ServicePrincipalNames : (example/username.companyname.com)
UserPrincipalName     : username@companyname.com
0

There are no other caches than: The replication time between domain controllers and sites. And the Memory Cache in the Active Directory Users and Computers console.

Try to close the ADUC console to force the data to be refreshed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.