Before moving to the cloud, it is important to carefully define your db needs, plan for the migration & understand prod. environment. This wp explains how to define what you need from a cloud provider, plan for the migration & what putting a cloud solution into practice entails.
COURSE of the MONTH
7 days, 22 hours left to enrollBecome a Premium Member and unlock a new, free course in leading technologies each month.
Solved
Removing duplicate SPNs (Service Name Providers)
Posted on 2010-08-24
I currently get errors in the system log on my Windows 2008 R2 domain controller daily, such as:
Event ID: 11
Source Name: KDC
The KDC encountered duplicate names while processing a Kerberos authentication request. The duplicate name is MSSQLSvc/IKSDB01.iks.bz:11
I googled this and found an article that makes the fix seem fairly straighforward:
http://technet.microsoft.com/en-us/library/cc733945(WS.10).aspx
Here is my output when I run: setspn -X
Checking domain DC=iks,DC=bz
Processing entry 2
MSSQLSvc/iksdb01.iks.bz:30
CN=IKSDB01,CN=Computers,DC
CN=Administrator,CN=Users,
MSSQLSvc/iksdb01.iks.bz:39
CN=IKSDB01,CN=Computers,DC
CN=Administrator,CN=Users,
MSSQLSvc/iksdb01.iks.bz:11
CN=IKSDB01,CN=Computers,DC
CN=Administrator,CN=Users,
MSSQLSvc/iksdb01.iks.bz:49
CN=IKSDB01,CN=Computers,DC
CN=Administrator,CN=Users,
MSSQLSvc/2000sql01.iks.bz:
CN=2000SQL01,CN=Computers,
CN=Administrator,CN=Users,
MSSQLSvc/SHAREPOINT.iks.bz
CN=SHAREPOINT,CN=Computers
CN=Administrator,CN=Users,
found 6 groups of duplicate SPNs.
The article then gives instructions using setspn -D<SPN> <computer_name> to delete these.
Some questions:
#1. Given the output of my duplicate SPNs, what would be command that I type to erase one of these.
#2. How do I know which duplicate to erase?
#3. If in doing this, I screw something up, is there a way to undo?
Thanks,
Jamie
Event ID: 11
Source Name: KDC
The KDC encountered duplicate names while processing a Kerberos authentication request. The duplicate name is MSSQLSvc/IKSDB01.iks.bz:11
I googled this and found an article that makes the fix seem fairly straighforward:
http://technet.microsoft.com/en-us/library/cc733945(WS.10).aspx
Here is my output when I run: setspn -X
Checking domain DC=iks,DC=bz
Processing entry 2
MSSQLSvc/iksdb01.iks.bz:30
CN=IKSDB01,CN=Computers,DC
CN=Administrator,CN=Users,
MSSQLSvc/iksdb01.iks.bz:39
CN=IKSDB01,CN=Computers,DC
CN=Administrator,CN=Users,
MSSQLSvc/iksdb01.iks.bz:11
CN=IKSDB01,CN=Computers,DC
CN=Administrator,CN=Users,
MSSQLSvc/iksdb01.iks.bz:49
CN=IKSDB01,CN=Computers,DC
CN=Administrator,CN=Users,
MSSQLSvc/2000sql01.iks.bz:
CN=2000SQL01,CN=Computers,
CN=Administrator,CN=Users,
MSSQLSvc/SHAREPOINT.iks.bz
CN=SHAREPOINT,CN=Computers
CN=Administrator,CN=Users,
found 6 groups of duplicate SPNs.
The article then gives instructions using setspn -D<SPN> <computer_name> to delete these.
Some questions:
#1. Given the output of my duplicate SPNs, what would be command that I type to erase one of these.
#2. How do I know which duplicate to erase?
#3. If in doing this, I screw something up, is there a way to undo?
Thanks,
Jamie
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
-
6
5
13 Comments
here you go
http://technet.microsoft.com/en-us/library/cc786325(WS.10).aspx
you can add delete using instructions in this article
Thank you
http://technet.microsoft.com/en-us/library/cc786325(WS.10).aspx
you can add delete using instructions in this article
Thank you
So the output there gives you the computer name and dupliate SPNs. Use the procedures Marcin described here to find the one you need to delete
http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/ba6a67c2-ee45-4dcc-9ce4-fb6ebceb1c2a/
Thanks
Mike
http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/ba6a67c2-ee45-4dcc-9ce4-fb6ebceb1c2a/
Thanks
Mike
For simplicity, lets use MSSQLSvc/iksdb01.iks.bz:11
I opened up AdsiEdit and was able to find this SPN under the ServicePrincipleName section of:
DC=iks,DC=bz -> CN=Computers -> CN=IKSDB01
DC=iks,DC=bz -> CN=Users -> CN=Administrator
IKSDB01 is one of our old servers running MS SQL SERVER 2000.
I have no problem with deleting one of the SPNs, and now know how to. Thank you!
I am still unsure as to which one to delete...
In the article he says:
Locate the westpex computer and find out what's the account in which secuirty context SQL Server service executes. If this is Administrator's account, delete the second one - otherwise (if this is a local System or Network Service account, delete the first one).
Where would I find this in SQL Server? Or would I locate this in services.msc?
From services.msc, if I look at the "Log In As" field under the various database instances, some of them have different values ... some say "IKS\Administrator" (our domain admin login), and some say "Local System". Is this what I'm looking for?
How will I be able to tell what MSSQLSvc/iksdb01.iks.bz:11
Thanks!
I opened up AdsiEdit and was able to find this SPN under the ServicePrincipleName section of:
DC=iks,DC=bz -> CN=Computers -> CN=IKSDB01
DC=iks,DC=bz -> CN=Users -> CN=Administrator
IKSDB01 is one of our old servers running MS SQL SERVER 2000.
I have no problem with deleting one of the SPNs, and now know how to. Thank you!
I am still unsure as to which one to delete...
In the article he says:
Locate the westpex computer and find out what's the account in which secuirty context SQL Server service executes. If this is Administrator's account, delete the second one - otherwise (if this is a local System or Network Service account, delete the first one).
Where would I find this in SQL Server? Or would I locate this in services.msc?
From services.msc, if I look at the "Log In As" field under the various database instances, some of them have different values ... some say "IKS\Administrator" (our domain admin login), and some say "Local System". Is this what I'm looking for?
How will I be able to tell what MSSQLSvc/iksdb01.iks.bz:11
Thanks!
some say "IKS\Administrator" (our domain admin login), and some say "Local System". Is this what I'm looking for?
Yes so administrator is what is used.
Take a look at part 2 of this DS team series
http://blogs.technet.com/b/askds/archive/2008/06/09/kerberos-authentication-problems-service-principal-name-spn-issues-part-2.aspx
about halfway down they use queryspn.vbs and go through the process
Thanks
Mike
Yes so administrator is what is used.
Take a look at part 2 of this DS team series
http://blogs.technet.com/b/askds/archive/2008/06/09/kerberos-authentication-problems-service-principal-name-spn-issues-part-2.aspx
about halfway down they use queryspn.vbs and go through the process
Thanks
Mike
Can't believe I forgot to mention Joes great entry http://blog.joeware.net/2008/07/17/1407/
@MKLine71, thank you! I think I need to explain it more ... I've attached a screenshot of the SQL Server section of services.msc ... you can see all the different database instances. Some are running under IKS\Administrator and some under Local System.
How am I to know which database instance corresponds to, for example: MSSQLSvc/iksdb01.iks.bz:11
SQLServer2000.jpg
How am I to know which database instance corresponds to, for example: MSSQLSvc/iksdb01.iks.bz:11
SQLServer2000.jpg
Ok, probably a pretty clunky way of doing this but I figured out a way to do this:
Using MSSQLSvc/iksdb01.iks.bz:11
From the command line, I run:
netstat -ano | findstr 1139
It returns: TCP 0.0.0.0:1139 0.0.0.0:0 LISTENING 1592
(1592 is the PID process ID?)
From the registry, I navigate to:
HKEY_LOCAL_MACHINE\SOFTWAR
The folders under here are all my database instances .. then I would navigate to the MSSQLServer folder underneath, and look for the "uptime_pid" key which is 1592.
So now I know that MSSQLSvc/iksdb01.iks.bz:11
Using MSSQLSvc/iksdb01.iks.bz:11
From the command line, I run:
netstat -ano | findstr 1139
It returns: TCP 0.0.0.0:1139 0.0.0.0:0 LISTENING 1592
(1592 is the PID process ID?)
From the registry, I navigate to:
HKEY_LOCAL_MACHINE\SOFTWAR
The folders under here are all my database instances .. then I would navigate to the MSSQLServer folder underneath, and look for the "uptime_pid" key which is 1592.
So now I know that MSSQLSvc/iksdb01.iks.bz:11
One last question .... if for SOME reason, I delete the WRONG SPN, how do I recover from this?
I assume that I could just change the authentication from within SQL Server, or just unjoin the server from the domain and rejoin it. Some reassurance would be great before I start deleting stuff with ADSIEdit :)
I assume that I could just change the authentication from within SQL Server, or just unjoin the server from the domain and rejoin it. Some reassurance would be great before I start deleting stuff with ADSIEdit :)
You can register the SPN again
http://support.microsoft.com/kb/909801/en-us
*** from the article
You can use a command that is similar to the following to register an SPN for an instance:
SetSPN –A MSSQLSvc/.:1433
Note If an SPN already exists, you must delete the SPN before you can reregister it. You may have to do this if the account mapping has changed. To deleted an existing SPN, you can use the SetSPN.exe tool together with the -D switch.
http://support.microsoft.com/kb/909801/en-us
*** from the article
You can use a command that is similar to the following to register an SPN for an instance:
SetSPN –A MSSQLSvc/.:1433
Note If an SPN already exists, you must delete the SPN before you can reregister it. You may have to do this if the account mapping has changed. To deleted an existing SPN, you can use the SetSPN.exe tool together with the -D switch.
Awesome ... all my questions have been answered and I feel like I actually comprehend this now. THANKS!
I tried it for the first one in my list ... deleted the duplicate SPN, and am successfully able to get to the database. I'll leave it like that for a couple days just to make sure nobody's affective and then I'll knock out all the other ones, going with Sharepoint LAST because that's our most important server here :)
Featured Post
If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
A Stored Procedure in Microsoft SQL Server is a powerful feature that it can be used to execute the Data Manipulation Language (DML) or Data Definition Language (DDL).
Depending on business requirements, a single Stored Procedure can return differe…
Had a business requirement to store the mobile number in an environmental variable. This is just a quick article on how this was done.
Attackers love to prey on accounts that have privileges.
Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…
Suggested Courses
Course of the Month7 days, 22 hours left to enroll
765 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.