2

We are using SP2013 on-premise. We need to switch a web application Windows Authentication from NTLM to Negotiate (Kerberos):

enter image description here

May I know what is the DNS requirement to support Kerberos?

In my test environment, the Kerberos is working at the beginning. Later when we switch the DNS server due to network issue, all the site collection under that web application is not working. I cannot even create a new site collection. I guess some setting is missed in new DNS server.

Improve this question
3
  • change DNS, build a new one? do you have your SPNs for the web app?
    – Waqas Sarwar MVP ♦
    Commented Jun 21, 2016 at 13:49
  • Waqas, I just build a new test env. I have not setup SPNs. However, after I change authentication types to "Negotiate (Kerberos)" users can still login. Will SharePoint auto change to NTLM if Kerberos is not feasible?
    – Mark L
    Commented Jun 23, 2016 at 9:46
  • yes, if Kerberos is not working then it auto failover to NTLM.
    – Waqas Sarwar MVP ♦
    Commented Jun 23, 2016 at 14:39

1 Answer 1

Reset to default
2

The following blog post discusses DNS records required for Active Directory function and includes information on Kerberos:

DNS Records that are required for proper functionality of Active Directory

Do you have a reverse lookup zone created? Without a reverse lookup zone, only the NetBIOS name of the server will be returned rather than the FQDN, which depending upon exactly how you have Kerberos configured may impact its function. See Is Kerberos Dependent on Reverse DNS Working? for some additional information on Kerberos and reverse DNS lookup.

Improve this answer
2
  • I run "Klist" command on client side, if there is no ticket contains "Server: HTTP/mywebappurl" is it mean Kerberos is not using?
    – Mark L
    Commented Jun 23, 2016 at 8:28
  • That certainly sounds like the case. I use KerbTray instead (download as part of the Windows 2003 Resource Kit tools from microsoft.com/en-us/download/details.aspx?id=17657) as I find it easier to use. Assuming that also reports that no tickets have been issued, then I'd say it was a fairly safe bet that this was the case.
    – Andy Dawson
    Commented Jun 23, 2016 at 10:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.