I realise this might be a non SharePoint question but it might have been one that someone has encountered. I have a customer site that has a component (custom code) that use AD Kerberos delegation to work and its not for this particular site. I have found that there is a number of Kerberos errors in the event log:

Error Code: 0x7  KDC_ERR_S_PRINCIPAL_UNKNOWN

The target name used was HTTP/portal.fqdn.blah This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Please ensure that the target SPN is registered on, and only registered on, the account used by the server.

I have also discovered that there is a duplicate account registered for http/portal and its fqdn variant;

A check with setspn -x reveals:

setspn -X
Checking domain DC=domain,DC=sub

Processing entry 6

http/portal is registered on these accounts:
        CN=account1,OU=Accounts,OU=subou,DC=domain,DC=sub
        CN=account2,OU=Accounts,OU=subou,DC=domain,DC=sub
found 2 groups of duplicate SPNs.

I attempted to unregister account1 and by doing this I couldn't even authenticate against the site, it almost seems as though it is the primary service account registered for http/portal.. I'm not entirely sure how to progress but I know that really it should only be 1 account registered for http/portal

I realise this might be a non SharePoint question but it might have been one that someone has encountered. I have a customer site that has a component (custom code) that use AD Kerberos delegation to work and its not for this particular site. I have found that there is a number of Kerberos errors in the event log:

Error Code: 0x7  KDC_ERR_S_PRINCIPAL_UNKNOWN

The target name used was HTTP/portal.fqdn.blah This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Please ensure that the target SPN is registered on, and only registered on, the account used by the server.

I have also discovered that there is a duplicate account registered for http/portal and its fqdn variant;

A check with setspn -x reveals:

setspn -X
Checking domain DC=domain,DC=sub

Processing entry 6

http/portal is registered on these accounts:
        CN=account1,OU=Accounts,OU=subou,DC=domain,DC=sub
        CN=account2,OU=Accounts,OU=subou,DC=domain,DC=sub
found 2 groups of duplicate SPNs.

Removing the duplicate 'account2' and with the site set for NTLM and Negotiate I would assume that with only the correct account 'account1' remaining that the SPN would only be able to use that account.

I have been through this article windowsecurity.com/articles/… and removed the wrong service account entry, restarted the WFE and the problem persists. I'm both entries for KDC_ERR_S_PRINCIPAL_UNKNOWN – which according to the article means there isn’t a registered SPN for the site. And the KRB_AP_ERR_MODIFIED which we see as well indicates the wrong service account is being used to access the site. So the question is how do I know when the tickets are being issues by the correct service account?