Questions tagged [spn]
a service principal name (SPN) that is used to identify an instance of a service in a particular domain
23
questions with no upvoted or accepted answers
4
votes
1
answer
1k
views
Kerberos issues after new server of same name joined to domain
Environment: Windows Server 2012, 2 Domain Controllers, 1 domain.
A server called Sharepoint1 was joined to the domain (running
Sharepoint 2013 using NTLM).
The fresh install for Sharepoint1 (OS and ...
- 41
2
votes
0
answers
157
views
Kerberos Double Hop - SQL2014 HA - MSA's
OK, so i'm at my wits end.
We have a system which works perfectly in our UAT environment (not HA) but will not work in live.
so the config is:
dns A record to iis box
binding in iis on :80 to ...
- 138
1
vote
0
answers
250
views
Forest trust: SPN mismatch for non-fully-qualified name
Setup
All computers running Windows Server 2019.
Domain A
Item
Value
Fully Qualified
Domain Name
DomainA
DomainA.local
User
UserA
[email protected]
Server
FileServer
FileServer.DomainA.local
...
1
vote
0
answers
200
views
New SPN required when renaming server?
I am in the process of decommissioning a Win 2008 server, that runs an app that uses Kerberos authentication, and has an SPN created for our service account. The replacement server will be renamed to ...
- 11
1
vote
0
answers
99
views
Configure HTTP SPN for a domain user account on Windows Server 2012R2
I have a Windows 2012R2 Server and I would like to use Kerberos authentication with my IIS web applications. How do I set the SPN and map the users for HTTP and HTTPS services for a given use account ...
- 11
1
vote
0
answers
3k
views
Issues identifying SPNs
Background
We are performing a server move. In the process, new servers and service accounts have been created. I'm getting two issues which I think are related to SPN's:
I've created some SQL ...
- 165
1
vote
0
answers
539
views
Setting up SPN for SSRS in a CRM load balance environment
I'm getting this exception randomly in a CRM load balance LIVE environment when running Reports from CRM.
System.ServiceModel.Security.SecurityNegotiationException: A call to SSPI failed, see inner ...
- 131
1
vote
0
answers
686
views
Set SPN for all users in domain
I have a Windows 2008 R2 domain controller with more than 60 user accounts. Each time one of these users tries to connect to the DC authentication "falls back" to NTLM. Kerberos authentication fails ...
- 592
1
vote
0
answers
1k
views
Kerberos Issue on Aliased SharePoint Web Front Ends
I am having a problem with Kerberos working on SharePoint. Also note that I am a developer not a network guy so if I use the wrong terms I apologize but I hope my intent is clear.
We have two web ...
0
votes
0
answers
64
views
How to create a Service Principal Name (SPN) for an AWS RDS-managed SQL Server instance computer object in AD?
We are using AWS RDS for SQL Server, an AWS managed service. We joined our RDS to our self-managed AD:
We found the Active Directory Service Principal Name (SPN) for the RDS-managed-service database ...
0
votes
0
answers
206
views
Fail to remove duplicate SPN
I am seeing event id 4 on computers on my Windows domain, and according to MicroSoft. I have a duplicate, which appears to be confirmed by:
PS C:\Windows\system32> setspn -X
Checking domain DC=...
- 1,852
0
votes
0
answers
13
views
SPN not working in azdevOps when creating b2c tenant in azure
When creating a new b2c tenant using automation from azuredevOps , SPN doesn;t work..
Only option is to use endpoint authenticated user.
'Failed'.","details":[{"code":"...
0
votes
0
answers
712
views
New DC - AD Domain Services did not perform an authenticated remote procedure call (RPC) to another directory server because the desired (SPN) f
I recently added a Windows Serevr 2019 DC to my domain which already has three DCs across two sites.
The three existing DCs are Server 2012 R2 and the Domain and Forest levels are 2008 R2.
The new DC ...
- 1
0
votes
0
answers
970
views
KRB5KRB_AP_ERR_MODIFIED trying to use SPN credentials
I'm trying to set up a Windows 2019 system as an SMB server to work with third-party software on an external, non-Windows system that uses Kerberos to authenticate to the SMB server. This SMB server ...
0
votes
0
answers
467
views
Right SPN for Kerberos Auth to Webservice
I developed a webservice (hosted with OWIN not IIS) where my users have to authenticate with their domain credentials. Currently it's using NTLM and everything is working fine but I want to switch to ...
0
votes
0
answers
629
views
When is mapUser required -
I'm not sure I understand when & why mapUser is needed.
When you generate a keytab with ktpass you can map the Service Principal to a user wit mapUser. You can then kinit to the Service from an ...
0
votes
1
answer
880
views
Kerberos SPN for one FQDN on multiple servers
This is a bit of a weird one. I'm building a new web server hosted on a LAMP stack to replace an old IIS server. Its intended DNS name is currently occupied by the old server. I have SSL certificates ...
0
votes
0
answers
1k
views
Duplicate SPN for File Server Alias
I have two Samba4 AD domain members that serve a couple of replicated shares to users at two sites (same domain, different subnets). Bandwidth and latency don't allow for a clustered solution, so ...
- 1
0
votes
1
answer
2k
views
Duplicate SPN's - ADFS
Trying to setup ADFS with AD Connect. I get an error message when trying to add the ADFS service account. The error states that there is already an existing service account in the directory with the ...
0
votes
1
answer
785
views
Add Service Principal Name to Keytab file on Windows
What command can I run on windows to add a SPN to a keytab file on Windows? It seems all the documentation I can find is for linux.
- 131
0
votes
1
answer
545
views
Creating AD SPNs with realmd/sssd on Cent7
Is it possible to use the system tools provided by realmd/sssd on a CentOS7 system to create and write out service principals for Apache and other servers? Or are we still reliant on other tools, ...
- 101
0
votes
1
answer
1k
views
IIS Credential Delegation for AppPool in Integrated Pipeline mode
I know there have been mkore than a dozen articles on this topic, but for some reason I have not been able to find a solution.
Server WEB1 has IIS7.5 with a site using Windows Authentication (kernel ...
- 1,142
0
votes
1
answer
79
views
Windows Kerberos authentication and network protocols/ports
Got the following question. I have a windows forest A with a root domain A. A web server in domain A has a proper setup SPN. A user comes from another forest/domain, where a 2way transitive forest ...
- 21