Has anyone got SharePoint 2016 and Kerberos to work? I'm more Dev than IT Pro, so I'm struggling.

I'm trying to set up a farm consisting of a DC and a SharePoint2016 /SQL 2016 server on Hyper V. I've built them from scratch using Windows Server 2012 R2.

I've created my DC, and following accounts SP_SQL, SP_Farm and SP_Setup. I also have an administrator account for the domain (cf2016.com)

I've ensured my SharePoint server (cfSP2016) is trusted for delegation. (also disable all firewalls). I've created the SharePoint 2016 using Single-Server Farm Role.

SP_Setup is administrator on the SharePoint box, and I installed SharePoint with that account. When installing and asked for an account for the SharePoint farm I entered SP_Farm

I have put an A record in my DNS so that I can access SQL on my server as SQL2016.

SP_SQL has 2 SPNs set up, one for MSSQLSVC/SQL2016.cf2016.com:1433 and MSSQLSVC/SQL2016:1433 SP_Farm has 2 SPNs set up, one HTTP/cfsp2016.cf2016.com:2016 and HTTP/cfsp2016:2016.

Logged in as SP_Setup on the SharePoint machine, if I use IE I can access Central Admin, it goes straight in. If I use Chrome, Firefox it prompts me for username and password. None of the accounts work (administrator, SP_Farm, SP_Setup).

On the DC, if I try and access Central admin, using any browser, I'm prompted for username and password, but nothing works.

I've tried to search what the error messages mean, but not really sure of the steps I need to do to fix.

Error: A Kerberos error message was received:
on logon session Client Time:
Server Time: 10:32:58.0000 8/22/2016 Z
Error Code: 0x29 KRB_AP_ERR_MODIFIED
Extended Error:
Client Realm:
Client Name:
Server Realm: CF2016.COM
Server Name: SP_Farm
Target Name:
Error Text:
File: 3
Line: 587
Error Data is in record data.

And Error:
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server SP_Farm. The target name used was HTTP/CFSP2016.cf2016.com. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (CF2016.COM) is different from the client domain (CF2016.COM), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

I've have read lots of blogs but just not understanding how to fix. Checked for duplicates (none), deleted all SPNs and started again.

Can anyone simply explain the steps I should do to fix? If not, I'll stick with NTLM.


  • did you try from client PC /laptop not from server? – Waqas Sarwar MVP Aug 22 '16 at 14:16
  • also which account you used for SPfarm spn?\ – Waqas Sarwar MVP Aug 22 '16 at 14:19
  • I didn't try from a client PC/Laptop as they wouldn't be on the domain. It's all in Hyper V and only have DC and SharePoint machines in the domain. The service account that is running Central Admin is cf2016\SP_Farm this is the account I used for the SPN – Cann0nF0dder Aug 22 '16 at 14:26
  • is this an A record "cfsp2016.cf2016.com"? also check this social.technet.microsoft.com/Forums/sharepoint/en-US/… – Waqas Sarwar MVP Aug 22 '16 at 14:29
  • Yes it is an A record. I have seen that blog, your link refers too, I'm pretty sure I have done every step right. I'll have another look tomorrow morning. – Cann0nF0dder Aug 22 '16 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.