KDC Error 11 - duplicate SPN's for SQL Server

Posted on 2013-09-25
Medium Priority
Last Modified: 2013-09-27
Apologies, but I've been reading a lot about SPN's and my brain is melting and I don't want to break something trying to fix this.

My DC's have the following error:

Event Type:      Error
Event Source:      KDC
Event Category:      None
Event ID:      11
Date:            9/25/2013
Time:            10:15:01 AM
User:            N/A
Computer:      *DC1
There are multiple accounts with name MSSQLSvc/<sqlservername>.<domain>.local:1433 of type DS_SERVICE_PRINCIPAL_NAME.

When I run "setspn -X" on the sqlserver in question, I get these results:

Checking domain DC=<domain>,DC=local
Processing entry 0
MSSQLSvc/MSSQLSvc/<sqlservername>.<domain>.local is registered on these accounts:

MSSQLSvc/MSSQLSvc/<sqlservername>.<domain>.local:1433 is registered on these accounts:

found 2 groups of duplicate SPNs.

I know I need to run "setspn -D" to delete the duplicate SPN, but I'm not 100% sure what that is...

Please help!
Question by:RF-MDG
LVL 10

Expert Comment

by:Pramod Ubhe
ID: 39524265
i am also not expert on SPNs but dealt with them in past. there is no doubt that you need to delete one of the duplicate spns. Now in my env. usually SPNs are set on service accounts and not on servernames.

here you can delete the SPN on server object and test if that works.

If you are familiar with ADSI, i will recommend you to do the changes through it as it is a GUI based but any mistakes in ADSI will be non-reversal and may impact heavily.

if you are not sure then just use SETSPN command but make a note of all changes so that you can revert them back.

Accepted Solution

VirastaR earned 2000 total points
ID: 39524732

You got a read this...

Understanding SPN - http://blogs.iis.net/brian-murphy-booth/archive/2007/03/09/the-biggest-mistake-serviceprincipalname-s.aspx
Think of an SPN as a “username” used to identify a program that is busy dealing with credentials. And we're only allowed to talk to this program using its “username”. PERIOD. Simple! Yes, that's all an SPN is: a "username". And as with any username, the name itself isn't really that important. It is merely to make identifying a person (or entity) easier to remember to humans. In this particular case, however, there are some naming conventions for this "username". Okay, so what username (SPN) is the right one? And where do we set it? These 2 questions are where all the confusion lies. We split the SPN into 2 parts and occasionally 3 parts: The first part is the “service type” and the second part is the “host name”. And sometimes the 3rd part is present which is the “port”. In the end, however, all these different parts are simply used to come up with this "username" that we call the ServicePrincipalName.

Fixing duplicate SPNs (service principal name)

To figure out which one to delete, log on to the server where the service/daemon is hosted. Find out what it uses to log on to AD. In this case, it is a Microsoft SQL Server, and I can easily see what credentials it uses by checking services.msc, scrolling down to the service in question and viewing the 'log on as' column. It says 'Local Service', so therefore it uses the computer object. I can delete the SPN entry under the SQL Admin user object's SPN attribute.

Hope that helps:)
LVL 43

Expert Comment

by:Eugene Z
ID: 39526498
check this one: what it is and how to remove dups

The 411 on the KDC 11 Events

Author Comment

ID: 39528161
Kickass! Thanks for the help, it's all fixed now.

Featured Post

The 14th Annual Expert Award Winners

The results are in! Meet the top members of our 2017 Expert Awards. Congratulations to all who qualified!

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Occasionally there is a need to clean table columns, especially if you have inherited legacy data. There are obviously many ways to accomplish that, including elaborate UPDATE queries with anywhere from one to numerous REPLACE functions (even within…
Learn about cloud computing and its benefits for small business owners.
SQL Database Recovery Software repairs the MDF & NDF Files, corrupted due to hardware related issues or software related errors. Provides preview of recovered database objects and allows saving in either MSSQL, CSV, HTML or XLS format. Ensures recov…
Stellar Phoenix SQL Database Repair software easily fixes the suspect mode issue of SQL Server database. It is a simple process to bring the database from suspect mode to normal mode. Check out the video and fix the SQL database suspect mode problem.

587 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question