InstantForum.NET v2.9.0SQLServerCentralhttp://www.sqlservercentral.com/Forums/notifications@sqlservercentral.comSat, 18 May 2013 16:53:15 GMT20http://www.sqlservercentral.com/Forums/Topic907146-359-1.aspx[quote][b]merodach (2/20/2013)[/b][hr]BTW - I don't suffer from OCD, I suffer from CDO. It's just like OCD but the letters are in the right order :-D[/quote]i love that line! thanks for the chuckle!Wed, 20 Feb 2013 11:48:02 GMTLowellhttp://www.sqlservercentral.com/Forums/Topic907146-359-1.aspx"Bet you a dollar that you've done one or more of the following: pushed for standardized server names, spent hours writing SQL Server maintenance related TSQL scripts that are SQL Server version independent, campaigned to have your programmers use three part naming in their code, fought for standardized database names across all dev, test and prod instances."Server name standards - Oh yeah, been there done that for years. The rest? I appreciate the compliment but I'm afraid I'm not a DBA, just a guy who got hooked into fixing problems when the former so-called "DBA"s got stuck, which was far too often. Thankfully we have a real DBA at work now and my headaches have been greatly reduced.My biggest push lately has been to get the programmers to use CNAMEs instead of FQDNs, or much worse NETBIOS names - makes things SO MUCH EASIER when a SQL server goes 'poof' and joins the dead kit pile.BTW - I don't suffer from OCD, I suffer from CDO. It's just like OCD but the letters are in the right order :-DWed, 20 Feb 2013 10:24:37 GMTmerodachhttp://www.sqlservercentral.com/Forums/Topic907146-359-1.aspxmerodach;Kudos to you, you grand-super-DBA you. Wish I had some imaginary internet points to give you right now. Why? Well, for not only posting the details of your your problem but following through with the answer after no one responded. This morning, one of our Systems techs sent me an EventID 11 Event Log entry identical to the one you've described. I've worked SQL Server KERBEROS issues in the past and one thing that they all have in common is that in no way, other than luck, will one find the cause and solution for one a KERBEROS issue in a single day of research. Now, thanks to you and your OCD-tendencies, I get to pop back with an intelligent analysis and easy solution the same day the issue was raised. Total win-win for me. You rock, you rock star. Thanks!And as to the OCD statement, it was said in a tone of complete respect. See, it takes one DBA with OCD to know one, eh? Bet you a dollar that you've done one or more of the following: pushed for standardized server names, spent hours writing SQL Server maintenance related TSQL scripts that are SQL Server version independent, campaigned to have your programmers use three part naming in their code, fought for standardized database names across all dev, test and prod instances. Any of that sound familiar? :-).Thanks! Tripp SouthernTue, 19 Feb 2013 14:36:05 GMTtrea_johnsonhttp://www.sqlservercentral.com/Forums/Topic907146-359-1.aspxYou'll need the setspn utility. You can get it here:[url=http://www.microsoft.com/downloads/details.aspx?FamilyID=5fd831fd-ab77-46a3-9cfe-ff01d29e5c46&displaylang=en]SETSPN download on MS's site[/url]I've run it from XPSP3 and Server 2003. You just need an account with sufficient rights to do admin work on the domain.Once you've got that you can run it against the server's SPNs.To list the SPNs currently assigned to the server:[code="other"]setspn -L server1.domain.com[/code]A typical delete command would be like this:[code="other"]setspn -D MSSQLSvc/server1.domain.com:1433 server1.domain.com[/code]If you need to remove the SPNs from an account (the opposite of what I needed) you have to run ADSI edit to get to that information.Tue, 11 May 2010 07:29:40 GMTmerodachhttp://www.sqlservercentral.com/Forums/Topic907146-359-1.aspxHow did you do that? I am having the same issue, it showed up in my backup exec out of the blue.Tue, 11 May 2010 07:07:44 GMTchristinahargrovehttp://www.sqlservercentral.com/Forums/Topic907146-359-1.aspxLooks like I'm going to answer my own question:The answer is to delete the SPNs from the machinesTue, 04 May 2010 11:04:08 GMTmerodachhttp://www.sqlservercentral.com/Forums/Topic907146-359-1.aspxDeleting the SPNs from the service account results in no access using windows authentication.Again - anyone got any suggestions?Tue, 27 Apr 2010 11:30:22 GMTmerodachhttp://www.sqlservercentral.com/Forums/Topic907146-359-1.aspxSince nobody has replied I am going to try removing the SPNs from the domain based service account and see what happens.Mon, 26 Apr 2010 14:22:37 GMTmerodachhttp://www.sqlservercentral.com/Forums/Topic907146-359-1.aspxI'm seeing this event in my domain system event logs:EventID : 11There are multiple accounts with name MSSQLSvc/server1.domain.com:1433 of type DS_SERVICE_PRINCIPAL_NAME.EventID : 11There are multiple accounts with name MSSQLSvc/server2.domain.com:1433 of type DS_SERVICE_PRINCIPAL_NAME.EventID : 11There are multiple accounts with name MSSQLSvc/server3.domain.com:1433 of type DS_SERVICE_PRINCIPAL_NAME.I've tracked down the duplicates but I'm not sure how to resolve the issue.We use a domain account to run the SQL services on three different machines. The domain service account has SPNs for each of the SQL boxes like so:MSSQLSvc/server1.domain.com:1433MSSQLSvc/server2.domain.com:1433MSSQLSvc/server3.domain.com:1433Do I:a] do nothingb] delete the SPN from each of the server objectsc] delete the SPNs from the service account objectd] some combination of b and ce] __________?I'm leery of doing "b" and I'm not sure of the impact of "c". Everything I have found searching talks of two domain [b][i]machines[/i][/b] but not the situation of machine+serviceaccount. Any suggestions?Tue, 20 Apr 2010 12:16:13 GMTmerodach