I realise this might be a non SharePoint question but it might have been one that someone has encountered. I have a customer site that has a component (custom code) that use AD Kerberos delegation to work and its not for this particular site. I have found that there is a number of Kerberos errors in the event log:
Error Code: 0x7 KDC_ERR_S_PRINCIPAL_UNKNOWN The target name used was HTTP/portal.fqdn.blah This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Please ensure that the target SPN is registered on, and only registered on, the account used by the server.
I have also discovered that there is a duplicate account registered for http/portal and its fqdn variant;
A check with setspn -x reveals:
setspn -X Checking domain DC=domain,DC=sub Processing entry 6 http/portal is registered on these accounts: CN=account1,OU=Accounts,OU=subou,DC=domain,DC=sub CN=account2,OU=Accounts,OU=subou,DC=domain,DC=sub found 2 groups of duplicate SPNs.
Removing the duplicate 'account2' and with the site set for NTLM and Negotiate I would assume that with only the correct account 'account1' remaining that the SPN would only be able to use that account.
I have been through this article windowsecurity.com/articles/… and removed the wrong service account entry, restarted the WFE and the problem persists. I'm both entries for KDC_ERR_S_PRINCIPAL_UNKNOWN – which according to the article means there isn’t a registered SPN for the site. And the KRB_AP_ERR_MODIFIED which we see as well indicates the wrong service account is being used to access the site. So the question is how do I know when the tickets are being issues by the correct service account?