KDC Error 11 - duplicate SPN's for SQL Server

Apologies, but I've been reading a lot about SPN's and my brain is melting and I don't want to break something trying to fix this.

My DC's have the following error:

Event Type:      Error
Event Source:      KDC
Event Category:      None
Event ID:      11
Date:            9/25/2013
Time:            10:15:01 AM
User:            N/A
Computer:      *DC1
Description:
There are multiple accounts with name MSSQLSvc/<sqlservername>.<domain>.local:1433 of type DS_SERVICE_PRINCIPAL_NAME.


When I run "setspn -X" on the sqlserver in question, I get these results:

Checking domain DC=<domain>,DC=local
Processing entry 0
MSSQLSvc/MSSQLSvc/<sqlservername>.<domain>.local is registered on these accounts:
        CN=sqlservice,CN=Users,DC=<domain>,DC=local
        CN=Administrator,CN=Users,DC=<domain>,DC=local
        CN=<sqlservername>,OU=Servers,DC=<domain>,DC=local

MSSQLSvc/MSSQLSvc/<sqlservername>.<domain>.local:1433 is registered on these accounts:
        CN=sqlservice,CN=Users,DC=<domain>,DC=local
        CN=Administrator,CN=Users,DC=<domain>,DC=local
        CN=<sqlservername>,OU=Servers,DC=<domain>,DC=local

found 2 groups of duplicate SPNs.


I know I need to run "setspn -D" to delete the duplicate SPN, but I'm not 100% sure what that is...

Please help!
RF-MDGAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Pramod UbheCommented:
i am also not expert on SPNs but dealt with them in past. there is no doubt that you need to delete one of the duplicate spns. Now in my env. usually SPNs are set on service accounts and not on servernames.

here you can delete the SPN on server object and test if that works.

If you are familiar with ADSI, i will recommend you to do the changes through it as it is a GUI based but any mistakes in ADSI will be non-reversal and may impact heavily.

if you are not sure then just use SETSPN command but make a note of all changes so that you can revert them back.
0
VirastaRUC Tech Consultant Commented:
Hi,

You got a read this...

Understanding SPN - http://blogs.iis.net/brian-murphy-booth/archive/2007/03/09/the-biggest-mistake-serviceprincipalname-s.aspx
Think of an SPN as a “username” used to identify a program that is busy dealing with credentials. And we're only allowed to talk to this program using its “username”. PERIOD. Simple! Yes, that's all an SPN is: a "username". And as with any username, the name itself isn't really that important. It is merely to make identifying a person (or entity) easier to remember to humans. In this particular case, however, there are some naming conventions for this "username". Okay, so what username (SPN) is the right one? And where do we set it? These 2 questions are where all the confusion lies. We split the SPN into 2 parts and occasionally 3 parts: The first part is the “service type” and the second part is the “host name”. And sometimes the 3rd part is present which is the “port”. In the end, however, all these different parts are simply used to come up with this "username" that we call the ServicePrincipalName.

Fixing duplicate SPNs (service principal name)
http://blog.practicaltech.ca/2011/02/fixing-duplicate-spns-service-principal.html

To figure out which one to delete, log on to the server where the service/daemon is hosted. Find out what it uses to log on to AD. In this case, it is a Microsoft SQL Server, and I can easily see what credentials it uses by checking services.msc, scrolling down to the service in question and viewing the 'log on as' column. It says 'Local Service', so therefore it uses the computer object. I can delete the SPN entry under the SQL Admin user object's SPN attribute.

Hope that helps:)
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Eugene ZCommented:
check this one: what it is and how to remove dups

The 411 on the KDC 11 Events
http://blogs.technet.com/b/askpfeplat/archive/2012/03/29/the-411-on-the-kdc-11-events.aspx
0
RF-MDGAuthor Commented:
Kickass! Thanks for the help, it's all fixed now.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.