Need Help Understanding Kerberos SPN Problem

Tech-Archive recommends: Fix windows errors by optimizing your registry

I either don't understand how to use SETSPN, or I have some serious problem
with Kerberos in our domain. For a domain hq.corp.com and a domain
controller my-dc1, the following SETSPN commands executed at the console of
the domain controller are returning errors indicating the account doesn't
exist:

SETSPN -L hq.corp.com
SETSPN -L my-dc1

I've read the Microsoft documents on troubleshooting Kerberos, and I don't
understand SPNs any better after reading those than I did before. They
talk about SPNs in some very vague way and they don't give examples to tie
SPNs together concretely with objects you see in the actual AD management
applications.

I see the special reserved user account krbtgt, and I gather this is an SPN?

I'm getting krb5kdc_err_s_principal_unknown errors on some member servers
when they request a Kerberos host/hq.corp.com ticket.

I don't understand if member servers should be getting the host/<domain>
ticket.
I don't understand why they need it or how they use it.
I don't understand what the implications are if they don't get this ticket.
I don't understand how this relates to SPNs.
I don't understand how to investigate the cause of this.
I don't understand how to fix it.

Mostly, I don't understand. :)

Any help in understanding if we have a problem here is appreciated.

--
Will


.

Relevant Pages

  • Re: kerberos tickets and the SPNs
    ... You can also use setspn -A host/fqdn in lowercase. ... BTW the original netjoin tool from MS used computer accounts not user ... kerberos tickets and the SPNs ...
    (comp.protocols.kerberos)
  • Re: Need Help Understanding Kerberos SPN Problem
    ... And so I figure you're probably spending a while troubleshooting this. ... manually, using Setspn. ... with Kerberos in our domain. ... understand SPNs any better after reading those than I did before. ...
    (microsoft.public.windows.server.active_directory)
  • Re: kerberos tickets and the SPNs
    ... kerberos tickets and the SPNs ... Resetting the SPNs with setspn -R, ... Argonne National Laboratory ...
    (comp.protocols.kerberos)
  • Re: kerberos tickets and the SPNs
    ... You can also use setspn -A host/fqdn in lowercase. ... BTW the original netjoin tool from MS used computer accounts not user accounts. ... kerberos tickets and the SPNs ...
    (comp.protocols.kerberos)
  • Re: Performance issues With Impersonation and Delegation
    ... Start with the SPNs though. ... service account in AD with an LDAP query and return its servicePrincipalName ... I enabled Kerberos logging on the web service server and now for every web ...
    (microsoft.public.dotnet.framework.aspnet.security)