February 7, 2013 at 12:30 am
I have windows 2003 Server with SQL Server 2005 and Windows 2008 with SQL 2008 R2
Is there any difference in SPN registration ?(setspn)
When I put SETSPN -L service account I found multiple entry for the MSSQLSVC for the same server with port number and without portnumber.Would it cause any issue?
February 7, 2013 at 1:19 am
Why don't you just show us your list of SPNs?
The most important entries are:
setspn -A MSSQLSvc/<Fully qualified domain name of the server>:1433 domain\Account
setspn -A MSSQLSvc/<servername without domain>:1433 domain\Account
(Reporting Services)
setspn -A HTTP/<Fully qualified domain name of the server>:80 domain\Account
setspn -A HTTP/<servername without domain>:80 domain\Account
Greetz sql pizza
Greetz
Query Shepherd
February 7, 2013 at 1:32 am
Found this
MSSQLSvc/SQL405.lds.asp..com:1433
MSSQLSvc/SQL405.lds.asp..com
February 7, 2013 at 1:40 am
I don't think it hurts. I would say you don't need the entry without the port, but as long as it makes no troubles leave it like it was.
Better get a second opinion bout that :-)!
Greetz
Query Shepherd
February 7, 2013 at 2:03 am
I take it the ..com is a typo, or is that really your domain extension?
The first one is ok, the second is the FQDN when it just needs to be the NetBIOS name, so I would remove it and just create it as SQL405 without the domain extension
SETSPN -A MSSQLSvc/SQL405:1433 Domain\Account
SETSPN -A MSSQLSvc/SQL405.lds.asp.com:1433 Domain\Account
February 7, 2013 at 3:35 am
thanks all for the help.
As per my knowledge SQL Server will unregister SPN during shutdown and reregister during startup.
Some of my SQL Servers there is no spn.exe(Windows support tools not installed).Then How this unregister & re register would work ?
February 7, 2013 at 3:37 am
The service accounts need access to do the SPN registration unregistrations in AD, if it doesnt then it will have to be a manual registration unregistration.
February 7, 2013 at 4:23 am
setspn.exe would be normally in C:\Programfiles\Supporttools
In my case this folder and setspn.exe not there.it seems support tools for windows not installed.
How do the registration works ? windows support tools is mandatory ?
February 7, 2013 at 4:31 am
It communicates directly with your AD server as an automatic request if it has the right permissions to do so, it doesnt need the SetSPN tool to be installed.
SetSPN tool is only required for manual requests.
February 7, 2013 at 4:44 am
The only time the auto registering of SPNs will work when running as a domain account is if the account is an administrator or it has been granted readServicePrincipalname and writeServicePrincipalname permissions. Since the user account is low privilege this doesnt usually happen.
You can also use ADSIEdit to directly access the AD catalog and enter the values or grant the permissions mentioned above.
-----------------------------------------------------------------------------------------------------------
"Ya can't make an omelette without breaking just a few eggs" 😉
Viewing 10 posts - 1 through 9 (of 9 total)
You must be logged in to reply to this topic. Login to reply