We have 3 servers. One running SQL and 2 running Sharepoint. Both Sharepoint servers are acting as WFE's using NLB.

We have 2 Web Applications people.domain.local for our mysites and intranet.domain.local for all the rest of our content. Right now both are running on different application pools but using the same account. I have created an SPNs for the account. HTTP/people, HTTP/people.domain.local, HTTP/intranet, and HTTP/intranet.domain.local

I have added delegation to both WFE's and the application pool account but from the logs it appears that the users are logging in with NTLM still. I have also set the web applications to use Kerberos.

Is there something I am missing?

The part I'm missing.... My users including myself are users on a different domain. When I try to authenticate as a user of the same domain that the servers are part of I don't have any issues. Could this be something wrong with the trust?

5 Answers 5


Kerberos is definitely tricky to get right. I would recommend following the instructions in the following document exactly and in detail. Any small detail can break it and troubleshooting is painful.


Regarding multiple domains, here is what it has to say:

The scenarios in this set of articles about Kerberos authentication require that the SharePoint Server service and external data sources reside in the same Windows domain, which is required for Kerberos constrained delegation. The Kerberos protocol supports two kinds of delegation, basic (unconstrained) and constrained. Basic Kerberos delegation can cross domain boundaries in a single forest, but cannot cross a forest boundary regardless of trust relationship. Kerberos constrained delegation cannot cross domain or forest boundaries in any scenario.


Did you also configure the following IIS 7.x setting:



  • I did that in C:\Windows\System32\inetsrv\config\applicationHost.config and still get the same thing. I did an iis reset on both hosts.
    – Mark Davis
    Commented Nov 17, 2011 at 19:25
  • 1
    If this is SharePoint 2010 you cannot use Kernel mode AuthN - and useAppPoolCredentials is a kernel mode setting! Commented Jan 17, 2012 at 17:20

Two things to check into:

  1. Make sure that you have a two-way trust between your domains
  2. If you're accessing the servers using FQDN - make sure that that FQDN is in the Intranet sites in IE
  • Two-way trust isn't exactly required unless you use BI applications.
    – Jussi Palo
    Commented Jan 24, 2012 at 20:53

In IIS, navigate to your site(s) which has the problem. Click the "Authentication" button. Click on "Windows Authentication" and in the Actions pane, click "Providers". Move Kerberos above NTLM. Now Kerberos will always be tried first and then it will try with NTLM if Kerbeos fails.


Have you checked for duplicate SPNs in the forest?


Use setspn -x

Hope that helps! Norma =)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.