Re: How can I list all service principals in a Windows 2003 Active Directory?

Tech-Archive recommends: Fix windows errors by optimizing your registry

Well HTTP/ is one of the "special" mapped SPNs that get remapped to HOST/. You can see the whole list of SPNs mapped this way by looking at the NTDS Service object. As shown

F:\Dev\CPP\AdMod>adfind -config -f objectcategory=nTDSService spnmappings

AdFind V01.31.00cpp Joe Richards (joe@xxxxxxxxxxx) March 2006

Using server: 2k3dc11.joe.com:389
Directory: Windows Server 2003
Base DN: CN=Configuration,DC=joe,DC=com

dn:CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=joe,DC=com
>sPNMappings: host=alerter,appmgmt,cisvc,clipsrv,browser,dhcp,dnscache,replicator,eventlog,eventsystem,policyagent,oakley,dmserver,dns,mcsvc,fax,msiserver,ias,messenger,netlogon,ne
tman,netdde,netddedsm,nmagent,plugplay,protectedstorage,rasman,rpclocator,rpc,rpcss,remoteaccess,rsvp,samss,scardsvr,scesrv,seclogon,scm,dcom,cifs,spooler,snmp,schedule,tapisrv,trk
svr,trkwks,ups,time,wins,www,http,w3svc,iisadmin,msdtc


1 Objects returned



As for finding SPNs, you can use my adfind which is a command line AD query tool or LDP which is GUI or any number of LDAP based tools or as you found, setspn.

If you wanted to look at all machines in your forest which have K1 as part of the SPN you could do something like

adfind -gc -b -f serviceprincipalname=*k1* serviceprincipalname

or more efficiently... assume that there is a host/k1 and do something like

adfind -gc -b -f serviceprincipalname=host/k1 serviceprincipalname


joe



--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm


w-ij-n wrote:
Hi All

I have an IIS server (k1) that's installed in a Windows 2003 AD. When I
browse to a page on the server that's protected with Integrated Windows
Authentication, the kerbtray.exe tool shows a new ticket for HTTP/k1 in
the local Kerberos ticket cache. This means that a service principal
called HTTP/k1 should be registered somewhere in the AD. Is there a way
I can list all these service principals?

I try the setspn.exe tool from the Resource Kit but it only shows:

C:\Program Files\Resource Kit>setspn -L k1
Registered ServicePrincipalNames for CN=K1,CN=Computers,DC=n3,DC=local:
NtFrs-88f5d2bd-b646-11d2-a6d3-00c04fc9b232/k1.n3.local
HOST/K1
HOST/k1.n3.local

Thanks in advance
Weijun

.

Relevant Pages

  • Re: ADAM Bind to alias pointing local server fails
    ... you do not want duplicate SPNs that will break the Kerberos auth. ... ADAM replica that I will failover to if necessary. ... instance from another server. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Kerberos Help!
    ... I'd start by searching the forest for both of those SPNs and seeing if there ... SPNs, ... Check if server is trusted for delegation. ... Signature Algorithm = -138 ...
    (microsoft.public.windows.server.active_directory)
  • Re: IIS to IIS using kerberos and non-standard web port
    ... If you have created duplicate SPNs, ... When you created the SPN for the backend server, ... > web services on a separate IIS server. ... > run my webservices server on 8080 web port. ...
    (microsoft.public.inetserver.iis.security)
  • Re: How can I list all service principals in a Windows 2003 Active Directory?
    ... Try ldp.exe or ADFind to do queries for specific SPNs (servicePrincipalName ... I generally always use ldp.exe for doing Kerberos/SPN stuff because it ... called HTTP/k1 should be registered somewhere in the AD. ... I can list all these service principals? ...
    (microsoft.public.windows.server.active_directory)
  • Re: SQL 2000 cluster, "cannot generate SSPI context", SPN entries
    ... You should only one of each of these entries and they should belong to the service account under which SQL Server is running. ... We normally put SPNs in for the NetBIOS name as well. ... K. Brian Kelley, brian underscore kelley at sqlpass dot org ... Should I see SPNs for the cluster node names, ...
    (microsoft.public.sqlserver.clustering)