• First you need to stop SQL and change the service account to a domain account. Best practise is to use a new account with no privleges (other than Instant File Iniatialisation and Lock Pages in Memory in Windows Group Policies). The account should not be used as a service account on any other box.

    Change the account using SQL Server Configuration Manager.

    Then someone who has privleges to update Active Directory will need to run the commands to manually register the SPN's as outlined here:

    http://msdn.microsoft.com/en-us/library/ms191153.aspx

    (under Manual SPN registration)

    Manual SPN Registration

    To register the SPN manually, the administrator must use the Setspn.exe tool that is provided with the Microsoft Windows Server 2003 Support Tools. For more information, see the Windows Server 2003 Service Pack 1 Support Tools KB article.

    Setspn.exe is a command line tool that enables you to read, modify, and delete the Service Principal Names (SPN) directory property. This tool also enables you to view the current SPNs, reset the account's default SPNs, and add or delete supplemental SPNs.

    The following example illustrates the syntax used to register manually register an SPN for a TCP/IP connection.

    setspn -A MSSQLSvc/myhost.redmond.microsoft.com:1433 accountname

    Note If an SPN already exists, it must be deleted before it can be reregistered. You do this by using the setspn command together with the -D switch. The following examples illustrate how to manually register a new instance-based SPN. For a default instance, use:

    setspn -A MSSQLSvc/myhost.redmond.microsoft.com accountname

    For a named instance, use:

    setspn -A MSSQLSvc/myhost.redmond.microsoft.com:instancename accountname

    Once that's done, you can run

    SELECT auth_scheme, * FROM sys.dm_exec_connections

    and check to see if any connections are now using KERBEROS authentication.