Solved

Duplicate service Principal Name (SPN) in SBS 2003 server, How do you remove the duplicate (the right) entry?

Posted on 2009-04-15
5
2,525 Views
Last Modified: 2012-08-14
Hi guys / ...girls

I have a duplicate SPN entry in active directory that is interfering with Backup Exec / Maybe?
The reason I say that is because with in Backup Exec, under the "Alerts" tab, it complains about the duplicate SPN names, and with in Event Viewer of Windows SBS it gives you a the following event ID:

Event Type:      Error
Event Source:      KDC
Event Category:      None
Event ID:      11
Date:            2009/04/15
Time:            11:56:12 AM
User:            N/A
Computer:      SERVER
Description:
There are multiple accounts with name MSSQLSvc/server.domainname.com:1433 of type DS_SERVICE_PRINCIPAL_NAME.

Now, I have two questions:
1) Would backup Exec stop working / not backing up because of a duplicate SPN's seeing that it has the exact error message with in Backup Exec alerts. (Because it aint working, Backup Exec that is, but what is new)
2) How do I get rid of the duplicate SPNs, and if you do find the duplicate SPN, which one is the right one to remove?

What I have done:
- I have research the problem and some white papers say it is as simple as duplicate computer names on the network, and that you have to take them of the domain and rejoin them as a different name, but what happens if it is your domain controller that is being mentioned in the error / duplicate name being mentioned in the error message?
- I have cleared all DNS's, scavanged stale records, cleared Wins, re-did DHCP and cleared all ARP caches.
- I downloaded Windows 2003 tools and installed it, ran LDP, connected to the active directory data base, and queried the duplicate SPN name, I really dont see duplicate SPN names.
- I tried the Microsoft solution just by restarting the server that did not work.
- Found a script to query duplicate SPN names, opend the output in Wordpad, searched for the exacp SPN and it found the following exact name entry twice:

servicePrincipalName: MSSQLSvc/server.domainname.com:1433

So, if you find a way to remove it, which one do you remove?

Thanks for all the reading, any help would greatly be appreciated,
0
Comment
Question by:wimpie_asg
  • 3
  • 2
5 Comments
 
LVL 23

Expert Comment

by:Iamthecreator
Comment Utility
This is purely cosmetic and should not cause any issues with the backups or BEWS performance
You will  need to use ADSIEDIT MMC to edit the Active Directory and remove the duplicate SPN
0
 
LVL 23

Assisted Solution

by:Iamthecreator
Iamthecreator earned 250 total points
Comment Utility
You can also use the SETSPN command with - D (setspn -D )
 
Remove the duplicate service prinicipal name
http://technet.microsoft.com/en-us/library/cc733945.aspx
 
(http://blogs.technet.com/askds/archive/2008/06/09/kerberos-authentication-problems-service-principal-name-spn-issues-part-2.aspx)
... we see duplicate Service Principal Name issues quite frequently. Usually this is when the Administrator has used the SetSPN on different accounts in an effort to get Kerberos Authentication to work. One great example of this is MS SQL. If you install MS SQL as an Administrator of the domain, it will add the MSSQLSVC SPN to the SQL Servers computer account; later an Administrator changes the SQL Service startup account from Local System to a domain account and Kerberos Authentication starts to fail. Usually we will find that the MSSQLSVC SPN is configured on both the computer account as well as the domain user account that is used to run the service.


Since you should remove only the duplicate servicePrincipalName, you must do that manually by using ADSIEDIT.msc



To do this, follow these steps:
Start the ADSI Edit tool. To do this, click Start, click Run, type adsiedit.msc, and then click OK.
Note The ADSI Edit tool is included with the Windows Server 2003 Support Tools (register the dll: regsvr32 adsiedit.dll ).
Connect to a domain controller if ADSI Edit is not already connected to a domain controller.
Expand Domain [domainControllerName.example.com], expand DC=milrose-ny,DC=com, and then expand CN=System Accounts.
Note If the account for which you want to modify the SPN is located in a different container, modify this path as appropriate.
Right-click CN=Administrator, and then click Properties.
On the Attribute Editor tab, click to select both the following check boxes:
"Show mandatory attributes
"Show optional attributes
In the Attributes list, click servicePrincipalName, and then click Edit
In the Multi-valued String Editor dialog box, click MSSQLSvc/mrcsql2k.milrose-ny.com:1433, and then click Remove.
Click OK x times, and then exit the ADSI Edit tool.
However, there is also a tool called AdMod.exe that can do that,
ttp://www.joeware.net/freetools/tools/admod/index.htm (http://www.joeware.net/freetools/tools/admod/index.htm)
AdMod.exe -b CN=Administrator,OU=System Accounts,DC=milrose-ny,DC=com "ServicePrincipalName:-:MSSQLSvc/mrcsql2k.milrose-ny.com"

 
0
 
LVL 3

Author Comment

by:wimpie_asg
Comment Utility
I am sorry to do this, yet, thank-you for the prompt reply!

This is the output when I run " ldifde -f SQL_SPN.txt -t 3268 -d"" -l servicePrincipalName -r
"(servicePrincipalName=*MSSQLSvc*)" -p subtree :


dn: CN=Administrator,CN=Users,DC=mydomain,DC=co,DC=za
changetype: add
servicePrincipalName: MSSQLSvc/server.mydomain.com:2773
servicePrincipalName: {14E52635-0A95-4a5c-BDB1-E0D0C703B6C8}/SERVER
servicePrincipalName:
 {14E52635-0A95-4a5c-BDB1-E0D0C703B6C8}/server.mydomain.com

dn: CN=SERVER,OU=Domain Controllers,DC=mydomain,DC=co,DC=za
changetype: add
servicePrincipalName: MSSQLSvc/server.mydomain.com:1433
servicePrincipalName: {14E52635-0A95-4a5c-BDB1-E0D0C703B6C8}/SERVER
servicePrincipalName:
 {14E52635-0A95-4a5c-BDB1-E0D0C703B6C8}/server.mydomain.com
servicePrincipalName: MSSQLSvc/server.mydomain.com
servicePrincipalName: exchangeMDB/server.mydomain.com
servicePrincipalName: exchangeMDB/SERVER
servicePrincipalName: exchangeRFR/server.mydomain.com
servicePrincipalName: exchangeRFR/SERVER
servicePrincipalName: exchangeAB/SERVER
servicePrincipalName: exchangeAB/server.mydomain.com
servicePrincipalName: SMTPSVC/SERVER
servicePrincipalName: SMTPSVC/server.mydomain.com
servicePrincipalName:
 NtFrs-88f5d2bd-b646-11d2-a6d3-00c04fc9b232/server.mydomain.com
servicePrincipalName: ldap/server.mydomain.com/ForestDnsZones.mydomain.com
servicePrincipalName: ldap/server.mydomain.com/DomainDnsZones.mydomain.com
servicePrincipalName: GC/server.mydomain.com/mydomain.com
servicePrincipalName: HOST/server.mydomain.com/mydomain
servicePrincipalName: HOST/SERVER
servicePrincipalName: HOST/server.mydomain.com
servicePrincipalName: HOST/server.mydomain.com/mydomain.com
servicePrincipalName:
 E3514235-4B06-11D1-AB04-00C04FC2DCD2/6471d076-f036-4e26-9b3c-f15bac5cd2f3/mydomain.com
servicePrincipalName:
 ldap/6471d076-f036-4e26-9b3c-f15bac5cd2f3._msdcs.mydomain.com
servicePrincipalName: ldap/server.mydomain.com/mydomain
servicePrincipalName: ldap/SERVER
servicePrincipalName: ldap/server.mydomain.com
servicePrincipalName: ldap/server.mydomain.com/mydomain.com
servicePrincipalName: DNS/server.mydomain.com

dn: CN=SQL,OU=SBSUsers,OU=Users,OU=MyBusiness,DC=mydomain,DC=co,DC=za
changetype: add
servicePrincipalName: MSSQLSvc/server.mydomain.co.za:1433

dn: CN=STORESCLERK01,CN=Computers,DC=mydomain,DC=co,DC=za
changetype: add
servicePrincipalName: MSSQLSvc/STORESCLERK01.mydomain.com
servicePrincipalName: HOST/STORESCLERK01
servicePrincipalName: HOST/STORESCLERK01.mydomain.com

dn: CN=SERVICEMAN01,CN=Computers,DC=mydomain,DC=co,DC=za
changetype: add
servicePrincipalName: MSSQLSvc/SERVICEMAN01.mydomain.com:1433
servicePrincipalName: HOST/SERVICEMAN01
servicePrincipalName: HOST/SERVICEMAN01.mydomain.com

dn: CN=ENGINEER,CN=Computers,DC=mydomain,DC=co,DC=za
changetype: add
servicePrincipalName: MSSQLSvc/Engineer.mydomain.com:1485
servicePrincipalName: HOST/ENGINEER
servicePrincipalName: HOST/Engineer.mydomain.com

I have just change my real domain to "mydomain.com", otherwise this whole document is as is. The duplicate SPN name in question is:

servicePrincipalName: MSSQLSvc/SERVICEMAN01.mydomain.com:1433

And I see it s listen twice, please confirm if this is correct in saying that, that is the actual duplicate SPN name.

Again, thanks for the quick reply...

0
 
LVL 3

Author Comment

by:wimpie_asg
Comment Utility
My appolegies, the SPN in question is:

MSSQLSvc/server.mydomain.com:1433

and not

MSSQLSvc/SERVICEMAN01.mydomain.com:1433

And I see it is listed twice, is it supose to be like that, or is that the real duplicate SPN in question related to the following EventID:

Event Type:      Error
Event Source:      KDC
Event Category:      None
Event ID:      11
Date:            2009/04/15
Time:            04:07:31 PM
User:            N/A
Computer:      SERVER
Description:
There are multiple accounts with name MSSQLSvc/server.mydomain.com:1433 of type DS_SERVICE_PRINCIPAL_NAME.

For more information, see Help and Support Center at http://
0
 
LVL 3

Accepted Solution

by:
wimpie_asg earned 0 total points
Comment Utility
Hi,

It seems like it was BackupExec that caused the duplicate SPN name. I have uninstalled Backup Exec, restarted teh server. and the Duplicate SPN was removed.

Thanks for your help, realy appreciated!
0

Featured Post

Too many email signature updates to deal with?

Do you feel like you are taking up all of your time constantly visiting users’ desks to make changes to email signatures? Wish you could manage all signatures from one central location, easily design them and deploy them quickly to users? Well, there is an easy way!

Join & Write a Comment

The use of stolen credentials is a hot commodity this year allowing threat actors to move laterally within the network in order to avoid breach detection.
A Bare Metal Image backup allows for the restore of an entire system to a similar or dissimilar hardware. They are highly useful for migrations and disaster recovery. Bare Metal Image backups support Full and Incremental backups. Differential backup…
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now