|
|
|
SSCertifiable
       
Group: General Forum Members
Last Login: Today @ 5:53 AM
Points: 5,204,
Visits: 11,158
|
|
you can generate the SPN's manually using
SETSPN.EXE
syntax is
setspn -A ServiceClass/Host: Port AccountName
so for sql instance is
setspn -A MSSQLSvc/mysqlserver.domain.co.uk:staticsqlportnumber domain\sqlserviceuseraccount
use setspn -L domain\sqlserviceuseraccount
to list the SPN's
-----------------------------------------------------------------------------------------------------------
"Ya can't make an omelette without breaking just a few eggs"
|
|
|
|
|
Hall of Fame
       
Group: General Forum Members
Last Login: Yesterday @ 9:36 AM
Points: 3,051,
Visits: 1,357
|
|
Hi Brian,
After testing giving the "Write Service PrincipalName" permission to a normal domain user (the account that starts the MSSQL service), I found out that it generates the SPN dynamically. I am planning to implement this on the production enviroment soon. Once again thank you for your help.
 My blog
|
|
|
|
|
Hall of Fame
       
Group: General Forum Members
Last Login: Yesterday @ 9:36 AM
Points: 3,051,
Visits: 1,357
|
|
Perry, thanks for your reply. You are right, I can use the setspn command to create the SPN manually. It is a good way to do it, but to give the "write service principal name" permission to the domain account is more flexible and that's why I decide to choose that approach.
 My blog
|
|
|
|
|
Forum Newbie
      
Group: General Forum Members
Last Login: Thursday, March 08, 2012 4:46 AM
Points: 1,
Visits: 22
|
|
| Hi, just to clarify the Write/Read SPN permission on Active Directory is not recommended on clusters as for the active directory replication delay can make you have some problems as the registration need to be done before the service is brought up, and when the cluster node fail over the SPN is gonna get deleted and re-added, so for clusters this is not recommended.
|
|
|
|
|
Ten Centuries
      
Group: General Forum Members
Last Login: Wednesday, May 08, 2013 1:33 AM
Points: 1,186,
Visits: 1,852
|
|
I am currently getting the error in sql server logs:
2011-04-19 08:59:10 - ! [298] SQLServer Error: 802, Cannot generate SSPI context [SQLSTATE HY000] 2011-04-19 08:59:10 - ! [382] Logon to server '(local)' failed (JobManager) 2011-04-19 08:59:10 - ! [298] SQLServer Error: 802, SQL Network Interfaces: The target principal name is incorrect. [SQLSTATE HY000] 2011-04-19 08:59:10 - ! [298] SQLServer Error: 802, Cannot generate SSPI context [SQLSTATE HY000] 2011-04-19 08:59:10 - ! [382] Logon to server '(local)' failed (ConnUpdateJobActivity_NextScheduledRunDate) 2011-04-19 08:59:10 - ! [298] SQLServer Error: 802, SQL Network Interfaces: The target principal name is incorrect. [SQLSTATE HY000] 2011-04-19 08:59:10 - ! [298] SQLServer Error: 802, Cannot generate SSPI context [SQLSTATE HY000] 2011-04-19 08:59:10 - ! [382] Logon to server '(local)' failed (ConnAttemptCachableOp) 2011-04-19 08:59:10 - ! [298] SQLServer Error: 802, SQL Network Interfaces: The target principal name is incorrect. [SQLSTATE HY000] 2011-04-19 08:59:10 - ! [298] SQLServer Error: 802, Cannot generate SSPI context [SQLSTATE HY000] 2011-04-19 08:59:10 - ! [382] Logon to server '(local)' failed (ConnAttemptCachableOp) 2011-04-19 09:18:14 - ! [298] SQLServer Error: 802, SQL Network Interfaces: The target principal name is incorrect. [SQLSTATE HY000] 2011-04-19 09:18:14 - ! [298] SQLServer Error: 802, Cannot generate SSPI context [SQLSTATE HY000] 2011-04-19 09:18:14 - ! [382] Logon to server '(local)' failed (SaveAllSchedules)
Thanks
|
|
|
|