1

We are using SP2013 on-premise. We need to switch a web application Windows Authentication from NTLM to Negotiate (Kerberos):

enter image description here

May I know what is the DNS requirement to support Kerberos?

In my test environment, the Kerberos is working at the beginning. Later when we switch the DNS server due to network issue, all the site collection under that web application is not working. I cannot even create a new site collection. I guess some setting is missed in new DNS server.

  • change DNS, build a new one? do you have your SPNs for the web app? – Waqas Sarwar MVP Jun 21 '16 at 13:49
  • Waqas, I just build a new test env. I have not setup SPNs. However, after I change authentication types to "Negotiate (Kerberos)" users can still login. Will SharePoint auto change to NTLM if Kerberos is not feasible? – Mark L Jun 23 '16 at 9:46
  • yes, if Kerberos is not working then it auto failover to NTLM. – Waqas Sarwar MVP Jun 23 '16 at 14:39
1

The following blog post discusses DNS records required for Active Directory function and includes information on Kerberos:

DNS Records that are required for proper functionality of Active Directory

Do you have a reverse lookup zone created? Without a reverse lookup zone, only the NetBIOS name of the server will be returned rather than the FQDN, which depending upon exactly how you have Kerberos configured may impact its function. See Is Kerberos Dependent on Reverse DNS Working? for some additional information on Kerberos and reverse DNS lookup.

  • I run "Klist" command on client side, if there is no ticket contains "Server: HTTP/mywebappurl" is it mean Kerberos is not using? – Mark L Jun 23 '16 at 8:28
  • That certainly sounds like the case. I use KerbTray instead (download as part of the Windows 2003 Resource Kit tools from microsoft.com/en-us/download/details.aspx?id=17657) as I find it easier to use. Assuming that also reports that no tickets have been issued, then I'd say it was a fairly safe bet that this was the case. – Andy Dawson Jun 23 '16 at 10:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.