Need help removing duplicate SPN



I am getting Event ID 11 errors indicating a duplicate SPN for MSSQL Service.
I used the TechNete script queryspn and it appears that instead of having two
computers with the same SPN I have one user and one computer with the same
registered SPN. The entries I see are:

CN=SQLSA,OU=Virtual,OU=Admins,OU=Accounts,OU=Bellevue,DC=MYDOMAIN,DC=LOCAL
Class: user
User Logon: SQLSA
-- MSSQLSvc/MYSERVER.MYDOMAIN.LOCAL:1433

CN=MYSERVER,OU=Non-Domain
Controllers,OU=Servers,OU=Computers,OU=Bellevue,DC=MYDOMAIN,DC=LOCAL
Class: computer
Computer DNS: MYSERVER.MYDOMAIN.LOCAL
-- MSSQLSvc/MYSERVER.MYDOMAIN.LOCAL:1433
-- HOST/MYSERVER
-- HOST/MYSERVER.MYDOMAIN.LOCAL

I have other SQL Servers that look identical to the computer entry that
don't have their MSSQL SPN duplicated in the User SQLSA so I'm guessing I
should delete the entry from the user using ADSIEDIT to clear the error. Is
that correct? I don't see two computers with that SPN.


While I'm here I have another question. We just upgraded a server from SQL
2005 STD to SQL 2008 ENT. Its MSSQL SPN entries are:

CN=MYSERVER2,OU=Non-Domain
Controllers,OU=Servers,OU=Computers,OU=Bellevue,DC=MYDOMAIN,DC=LOCAL
Class: computer
Computer DNS: MYSERVER2.MYDOMAIN.LOCAL
-- MSSQLSvc/MYSERVER2.MYDOMAIN.LOCAL
-- MSSQLSvc/MYSERVER2.MYDOMAIN.LOCAL:1433
-- HOST/MYSERVER2
-- HOST/MYSERVER2.MYDOMAIN.LOCAL

Is this server not creating a duplicate SPN error because one is appended
with :1443? I have other SQL servers and their entries all are appended with
:1443. They are all SQL 2005 boxes. Should I delete the appended SPN from AD
or should I leave it alone?



--
Tim
.



Relevant Pages

  • Re: SPN creation
    ... If SQL runs under a different account, then the SPN for SQL with the host name associated with that SQL must be assigned to the fixed service account. ... If there is more than one, Kerb will be attempted and fail. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Delegation problems
    ... There are no SPNs on the machine account. ... did you add an SPN to that service account in AD ... delegate from my web server to the SQL service on the DB server when I ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Delegation problems
    ... I did a search for the SPN and it came back with two ... When the SQL server was initially setup (by a FORMER ... administrator) he used his account as the service account for SQL ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Need help removing duplicate SPN
    ... account established for an spn. ... Kerberos on a sql server. ... Grant this account local admin privileges on the sql server server. ...
    (microsoft.public.windows.server.active_directory)
  • Re: ServiceClassName for defining WebService SPN
    ... permissions to delegate and you need Kerberos auth to the next service as ... Make sure the proper SQL SPNs are registered on ... Joe Kaplan-MS MVP Directory Services Programming ... will build an SPN for the target using the HTTP ...
    (microsoft.public.dotnet.security)