Duplicate names in AD causing kerberos errors

I get this error twice every hour or so on all my dcs.
The KDC encountered duplicate names while processing a Kerberos authentication request. The duplicate name is MSSQLSvc/servername.domain.com:1433 (of type DS_SERVICE_PRINCIPAL_NAME). This may result in authentication failures or downgrades to NTLM. In order to prevent this from occuring remove the duplicate entries for MSSQLSvc/servername.domain.com:1433 in Active Directory.


when i ran a listing of all SPN entries. I see the server itself has the principal name listed as well as the sql administrator account.

all other talk of this error suggests removing the bad server SPN but not sure which isn't supposed to have the entry. Server or AdminAccount?

i tried rebinding to AD but that didn't resolve the errors.

any help would be great.
LVL 1
deeburpAsked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
snusgubbenConnect With a Mentor Commented:
If the SQL service runs with the Network Service account, the SPN should be registered on the server object.

If the SQL service runs with a service account ("AdminAccount"), then the SPN should be registered on the user object.
0
 
Darius GhassemCommented:
Try deleting the AdminAccount
0
 
deeburpAuthor Commented:
delete the admin account itself or just the SPN information about the server service that is on the account?

ie this below:

dn: CN=adminaccountsql,OU=Administrators,DC=domain,DC=com
changetype: add
servicePrincipalName: MSSQLSvc/devserver.domain.com:1433
servicePrincipalName: MSSQLSvc/servername.domain.com:1433
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 
Darius GhassemCommented:
So, you are using Admin account multiple SQL servers?
0
 
deeburpAuthor Commented:
correct we have one used on both our production and dev servers
0
 
Darius GhassemCommented:
Alright try using a different account for the other SQL service that might clear the dup up
0
 
deeburpAuthor Commented:
well we actually don't have the dev server anymore.. so perhaps i can just delete that entry from the admin account?
0
 
Darius GhassemCommented:
Yeah give that a shot
0
 
deeburpAuthor Commented:
looks like this worked.. i have just the adminaccount running as the service so i've removed the spn for the server itself. so far no errors in the dc logs
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.