Has anyone got SharePoint 2016 and Kerberos to work? I'm more Dev than IT Pro, so I'm struggling.
I'm trying to set up a farm consisting of a DC and a SharePoint2016 /SQL 2016 server on Hyper V. I've built them from scratch using Windows Server 2012 R2.
I've created my DC, and following accounts SP_SQL, SP_Farm and SP_Setup. I also have an administrator account for the domain (cf2016.com)
I've ensured my SharePoint server (cfSP2016) is trusted for delegation. (also disable all firewalls). I've created the SharePoint 2016 using Single-Server Farm Role.
SP_Setup is administrator on the SharePoint box, and I installed SharePoint with that account. When installing and asked for an account for the SharePoint farm I entered SP_Farm
I have put an A record in my DNS so that I can access SQL on my server as SQL2016.
SP_SQL has 2 SPNs set up, one for MSSQLSVC/SQL2016.cf2016.com:1433 and MSSQLSVC/SQL2016:1433 SP_Farm has 2 SPNs set up, one HTTP/cfsp2016.cf2016.com:2016 and HTTP/cfsp2016:2016.
Logged in as SP_Setup on the SharePoint machine, if I use IE I can access Central Admin, it goes straight in. If I use Chrome, Firefox it prompts me for username and password. None of the accounts work (administrator, SP_Farm, SP_Setup).
On the DC, if I try and access Central admin, using any browser, I'm prompted for username and password, but nothing works.
I've tried to search what the error messages mean, but not really sure of the steps I need to do to fix.
Error:
A Kerberos error message was received:
on logon session
Client Time:
Server Time: 10:32:58.0000 8/22/2016 Z
Error Code: 0x29 KRB_AP_ERR_MODIFIED
Extended Error:
Client Realm:
Client Name:
Server Realm: CF2016.COM
Server Name: SP_Farm
Target Name:
Error Text:
File: 3
Line: 587
Error Data is in record data.
And Error:
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server SP_Farm. The target name used was HTTP/CFSP2016.cf2016.com. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (CF2016.COM) is different from the client domain (CF2016.COM), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.
I've have read lots of blogs but just not understanding how to fix. Checked for duplicates (none), deleted all SPNs and started again.
Can anyone simply explain the steps I should do to fix? If not, I'll stick with NTLM.
Thanks
