0

I inherited a sharepoint server. In the logs I found many Error level log entries called Security-Kerberos with Event ID 3 referencing Error Code: 0x7 DC_ERR_S_PRINCIPAL_UNKNOWN. After some research I found this technet article but after reading it, I am still unsure of what to do.

If I run setspn -X I get the following:

Checking domain DC=domain,DC=com
Processing entry 2
MSSQLSvc/server.domain.com:1433 is registered on these accounts:
    CN=Administrator,CN=Users,DC=domain,DC=com
    CN=Server,OU=serverOU,OU=Company,DC=domain,DC=com

MSSQLSvc/server.domain.com is registered on these accounts:
    CN=Administrator,CN=Users,DC=domain,DC=com
    CN=Server,OU=serverOU,OU=Company,DC=domain,DC=com

found 2 groups of duplicate SPNs.

I have tried removing the SPN but SharePoint stops functioning. How can I remove the duplicate SPN entries while keeping SharePoint up? Any pointers would be appreciated.

===================================================

>setspn -l administrator
Registered ServicePrincipalNames for CN=Administrator,CN=Users,DC=Domain,DC=com:
    MSSQLSvc/server.domain.com
    MSSQLSvc/server2.domain.com:1433
    MSSQLSvc/server3.domain.com:1433
    MSSQLSvc/server4.domain.com:1433
    MSSQLSvc/server5.domain.com:1433
    MSSQLSvc/server.domain.com:1433
    MSSQLSvc/server6.domain.com:1433
    MSSQLSvc/server7.domain.com:1433

I see that server is listed twice. One with the port assignment, and the other without.

>setspn -l server
Registered ServicePrincipalNames for CN=Server,OU=serverOU,OU=Company,DC=domain,DC=com:
    MSSQLSvc/server.domain.com:1433
    MSSQLSvc/server.domain.com
    TERMSRV/server.domain.com
    TERMSRV/server
    WSMAN/server.domain.com
    WSMAN/server
    RestrictedKrbHost/server
    HOST/server
    RestrictedKrbHost/server.domain.com
    HOST/server.domain.com

I tried to remove the port assignment from MSSQLSvc/server.domain.com in the SNPs list of 'Server' and added it to MSSQLSvc/server.domain.com in the SPN list of Administrator, which then broke SharePoint.

The account that runs the sharepoint services is called domain\sharepoint.

1 Answer 1

0

I dont know how you get the duplicate SPN, i tried the same thing i get the duplicate error.

Couple of things to check.

  • Under which account the SQL server Serivce is running on the server, check from Services console on the server.
  • keep the SPN for the ID which running the SQL
  • also run the Setspn -l Adminsitrator & Setspn -l server Adminsitraot & server are the 2 account mentioned in duplicate. Share the output.
5
  • I have appended the requested info to the original question. Commented Jun 12, 2014 at 19:45
  • i see it, so which account is running the SQL Server Service not sharepoint services...you have to check it from the SQL server
    – Waqas Sarwar MVP
    Commented Jun 12, 2014 at 20:34
  • the error you are getting, i believe the SPNs are not proper setup.
    – Waqas Sarwar MVP
    Commented Jun 12, 2014 at 20:41
  • From the SQL server, it looks like the services are ran by the local system and local service accounts. The SQL Server Agent service is ran by the Local System account. Should those services be run by the domain\sharepoint account? Commented Jun 12, 2014 at 21:09
  • i think this is your problem, you need to change the SQL server services account from local system to some Domain services account i.e domain\sql etc
    – Waqas Sarwar MVP
    Commented Jun 12, 2014 at 21:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.