Questions tagged [spn]

a service principal name (SPN) that is used to identify an instance of a service in a particular domain

Filter by
Sorted by
Tagged with
0 votes
0 answers
44 views

How to create a Service Principal Name (SPN) for an AWS RDS-managed SQL Server instance computer object in AD?

We are using AWS RDS for SQL Server, an AWS managed service. We joined our RDS to our self-managed AD: We found the Active Directory Service Principal Name (SPN) for the RDS-managed-service database ...
0 votes
1 answer
36 views

Windows Kerberos authentication and network protocols/ports

Got the following question. I have a windows forest A with a root domain A. A web server in domain A has a proper setup SPN. A user comes from another forest/domain, where a 2way transitive forest ...
1 vote
2 answers
100 views

Windows external domain trust Kerberos authentication on Power BI and external data sources, how?

Power BI Reporting Services in Forest1-DomainA (location F1-A). User accounts are in Forest2-DomainA (location F2-A). F1-A trusts F2-A. The VDI/RDS where the users login are in F1-A, the service is in ...
1 vote
1 answer
504 views

IIS and Windows Authentication - When does it use NTLM?

I have a gap in my understanding of Windows Authentication in IIS 10 while I was configuring kerberos delegation. For a client accessing the web server (IIS, with windows authentication enabled) and ...
0 votes
0 answers
162 views

Fail to remove duplicate SPN

I am seeing event id 4 on computers on my Windows domain, and according to MicroSoft. I have a duplicate, which appears to be confirmed by: PS C:\Windows\system32> setspn -X Checking domain DC=...
0 votes
0 answers
12 views

SPN not working in azdevOps when creating b2c tenant in azure

When creating a new b2c tenant using automation from azuredevOps , SPN doesn;t work.. Only option is to use endpoint authenticated user. 'Failed'.","details":[{"code":"...
0 votes
2 answers
166 views

Set SPN To SQL With NT AUthority

I am trying to add SPN entries for my SQL server but SQL server is running under an NT Authority account like SYSTEM or LOCAL SERVICE. When I put in the setspn code it says it can't find the user. Is ...
0 votes
0 answers
676 views

New DC - AD Domain Services did not perform an authenticated remote procedure call (RPC) to another directory server because the desired (SPN) f

I recently added a Windows Serevr 2019 DC to my domain which already has three DCs across two sites. The three existing DCs are Server 2012 R2 and the Domain and Forest levels are 2008 R2. The new DC ...
3 votes
2 answers
5k views

List all kerberized SPN's in Linux

Is there a way to list/show all SPN's in an kerberized AD using a Linux Client? In Windows one can use setspn -T <domain> -Q */* to get them. Is there something similar? Haven't found anything ...
8 votes
1 answer
23k views

"setspn -s" vs. "setspn -a"

According to the Setspn Overview, it's discouraged to use Setspn -A to add an SPN record and it's suggested to use Setspn -S instead. It's said that Setspn -S checks if SPN already exists before ...
0 votes
0 answers
947 views

KRB5KRB_AP_ERR_MODIFIED trying to use SPN credentials

I'm trying to set up a Windows 2019 system as an SMB server to work with third-party software on an external, non-Windows system that uses Kerberos to authenticate to the SMB server. This SMB server ...
0 votes
0 answers
448 views

Right SPN for Kerberos Auth to Webservice

I developed a webservice (hosted with OWIN not IIS) where my users have to authenticate with their domain credentials. Currently it's using NTLM and everything is working fine but I want to switch to ...
0 votes
1 answer
2k views

Duplicate SPN's - ADFS

Trying to setup ADFS with AD Connect. I get an error message when trying to add the ADFS service account. The error states that there is already an existing service account in the directory with the ...
0 votes
0 answers
604 views

When is mapUser required -

I'm not sure I understand when & why mapUser is needed. When you generate a keytab with ktpass you can map the Service Principal to a user wit mapUser. You can then kinit to the Service from an ...
2 votes
1 answer
2k views

Samba AD: Create keytab for computer without net ads join?

Gist: I have set up a samba as AD DC. I'd like to export a keytab for SPNs for a computer account only without having the computer to run samba itself, or issue net ads join. Running samba-tool domain ...
1 vote
1 answer
53 views

Restrict using Azure Service Principal by Humans

We have some people who are using SPs manually (themselves) to run commands and deploy resources from CLI. We need to prevent that and allow only services to use SPs, not Humans. Is there any way to ...
1 vote
0 answers
248 views

Forest trust: SPN mismatch for non-fully-qualified name

Setup All computers running Windows Server 2019. Domain A Item Value Fully Qualified Domain Name DomainA DomainA.local User UserA [email protected] Server FileServer FileServer.DomainA.local ...
6 votes
3 answers
70k views

Get SPN error when trying to join a machine to a domain

I am trying to join a Windows Server 2016 VM called BORON to a domain which has a Windows 2012 R2 domain controller. The DC name is SNOWDROP.DUCK.LOC When I try to join I get this error: The ...
3 votes
1 answer
2k views

Linux pod authenticate to MS-SQL windows server using keytab

Cannot get Kerberos auth working from linux to MS-SQL server on windows. Added new user in AD. New-ADUser -Name "user" -GivenName "user" -SamAccountName "user" -...
0 votes
2 answers
2k views

How to set the SPN for Postgres SSPI

I am trying to setup Postgres to support SSPI/Kerberos, however I think that I have not found out what the correct SPN that is needed to get it working. The background details: Service account for ...
1 vote
2 answers
2k views

RDP to an Alias

I have a server that has since been decommissioned and I have some services that have been moved over to another server however these servers still point to the old server so I have set up a Cname for ...
6 votes
3 answers
31k views

Will kerberos work with CNAMEs if I have the SPN created for the A record as well?

We are currently setting up a SQL 2012 environment and it will be used for storing data that will be accessed by SSRS in sharepoint integrated mode. We will be using Kerberos for authentication. ...
11 votes
2 answers
42k views

Permissions to create an spn

According to some of the documentation I've read the service account for SQL server will create an SPN when the database engine starts up, allowing for kerberos authentication. I haven't been able to ...
1 vote
0 answers
195 views

New SPN required when renaming server?

I am in the process of decommissioning a Win 2008 server, that runs an app that uses Kerberos authentication, and has an SPN created for our service account. The replacement server will be renamed to ...
3 votes
2 answers
408 views

setspn does not affect Active Directory Users

I run the setspn command for specific user on Domain Controller. C:\>setspn -s example/username.companyname.com username Checking domain DC=companyname,DC=com Registering ServiceprincipalNames ...
0 votes
1 answer
3k views

Why would setspn -q return "no such spn found" when setspn -l finds the spn?

I'm attempting to troubleshoot why windows authentication is failing for a website hosted in IIS at a customer site. When executing setspn -l serviceUser to list the spns associated with a service ...
0 votes
1 answer
858 views

Kerberos SPN for one FQDN on multiple servers

This is a bit of a weird one. I'm building a new web server hosted on a LAMP stack to replace an old IIS server. Its intended DNS name is currently occupied by the old server. I have SSL certificates ...
0 votes
0 answers
1k views

Duplicate SPN for File Server Alias

I have two Samba4 AD domain members that serve a couple of replicated shares to users at two sites (same domain, different subnets). Bandwidth and latency don't allow for a clustered solution, so ...
0 votes
1 answer
3k views

Web Application Proxy SPN Delegation

Hopefully this will be a quick one but I keep drawing a blank on how to do this even after some frantic searching online. I have recently been tasked with adding resiliency to our WAP (Web ...
2 votes
1 answer
4k views

SPN generation for multiple service account on a Web server

I am trying to achieve Azure SSO in my organisation. I have a web server hosting multiple websites and web application under those sites. Users access them in below fashion https:// < SiteName >...
0 votes
1 answer
780 views

Add Service Principal Name to Keytab file on Windows

What command can I run on windows to add a SPN to a keytab file on Windows? It seems all the documentation I can find is for linux.
5 votes
2 answers
9k views

Why does a SPN on a different host cause a server to lose its trust? How should I fix it?

I have a brand new server image that loses its trust as soon as it's joined to the domain. I suspect it's because of the duplicate SPN I discovered using the LDAP version of this Powershell script ...
6 votes
1 answer
17k views

Active Directory replication target principal name incorrect

I have a small 2 DC domain using Win 2008 R2 machines. Recently, one had to be restored using backup exec system recovery. Now the two are failing replication. I have ran DCDIAG on both (see below) ...
0 votes
1 answer
3k views

How to set an SPN for SQL Server on a Workgroup

I'm trying to remote connect to my Sql server 2016 instance on my home server running on a workgroup. I need to set an SPN to do this. All the guides out there seem to be related to setting the SPN ...
1 vote
0 answers
99 views

Configure HTTP SPN for a domain user account on Windows Server 2012R2

I have a Windows 2012R2 Server and I would like to use Kerberos authentication with my IIS web applications. How do I set the SPN and map the users for HTTP and HTTPS services for a given use account ...
2 votes
0 answers
157 views

Kerberos Double Hop - SQL2014 HA - MSA's

OK, so i'm at my wits end. We have a system which works perfectly in our UAT environment (not HA) but will not work in live. so the config is: dns A record to iis box binding in iis on :80 to ...
7 votes
2 answers
11k views

creating an SPN from a linux build server

I'm setting up a process which would automatically create the SPNs for newly exposed service URLs. I am aware of how to create an SPN with Windows using the setspn -A command with the right priviliges....
8 votes
1 answer
24k views

Create SPN with setspn.exe - Insufficient access rights

On a Windown Server 2008 Domain Controller, I'm attempting to add a Service Principal Name (SPN) to a user account 'Postmaster' in order to enable Kerberos authentication from a Communigate email ...
3 votes
2 answers
191 views

Are SPNs specific to Windows and Active Directory?

Are Service Principle Names specific to Active Directory on Windows? Or do they exist in Linux OpenLDAP / Kerberos KDC servers too?
1 vote
0 answers
3k views

Issues identifying SPNs

Background We are performing a server move. In the process, new servers and service accounts have been created. I'm getting two issues which I think are related to SPN's: I've created some SQL ...
3 votes
1 answer
14k views

SPN settings in a ADFS 3.0 lab setup

I am a developer trying to understand authentication with ADFS (2012 R2), so I am trying to setup an ADFS lab. I have found 2 guides: doc1 - http://technet.microsoft.com/en-us/library/dn280939.aspx ...
1 vote
2 answers
6k views

Windows Authentication KRB5KRB_AP_ERR_MODIFIED

Let me preface by saying, I've been on this issue for about a week and a half now and I can't figure it out. I think I'm close, but every time I've thought that so far, I was wrong. I've looked at ...
3 votes
1 answer
3k views

Kerberos Error APP_MODIFIED when using a CNAME DNS record

I have a production server, which I'll call CONTOSO\MachineA, running SQL Server. I have a development server, which I'll call CONTOSO\MachineB, running IIS. Both servers are running Windows Server ...
1 vote
1 answer
312 views

Is it possible for two legs of a service to have the same SPN? Or at least clients refer to a single identity?

For a WCF service "SuperService", installed on two separate servers "Server1" and "Server2" - is it possible to have a single SPN identity string to which the WCF client "SuperClient" can refer? Such ...
2 votes
2 answers
5k views

need help in setting up SPN for Kerberos Authentication

I am using IIS 7 for setting up a website under windows authentication. I am seeing authentication issue which i am almost sure that it is related to kerberos issue and i am wrongly setting up SPN. ...
0 votes
1 answer
542 views

Creating AD SPNs with realmd/sssd on Cent7

Is it possible to use the system tools provided by realmd/sssd on a CentOS7 system to create and write out service principals for Apache and other servers? Or are we still reliant on other tools, ...
1 vote
0 answers
674 views

Set SPN for all users in domain

I have a Windows 2008 R2 domain controller with more than 60 user accounts. Each time one of these users tries to connect to the DC authentication "falls back" to NTLM. Kerberos authentication fails ...
1 vote
0 answers
536 views

Setting up SPN for SSRS in a CRM load balance environment

I'm getting this exception randomly in a CRM load balance LIVE environment when running Reports from CRM. System.ServiceModel.Security.SecurityNegotiationException: A call to SSPI failed, see inner ...
3 votes
2 answers
7k views

Why should I not run setspn.exe on the domain controller?

I found several references (see below) on blogs that the setspn.exe utility should be run from either a client or server machine in the domain, but not from the domain controller itself. http://www....
14 votes
1 answer
41k views

Why is MS SQL Server Using NTLM Authentication?

Windows Server 2008 R2. SQL Server 2008 R2 installed. MSSQL Service runs as Local System. Server FQDN is SQL01.domain.com. SQL01 is joined to an Active Directory domain named domain.com. The ...