Background
We are performing a server move. In the process, new servers and service accounts have been created. I'm getting two issues which I think are related to SPN's:
I've created some SQL Linked servers (using 'current security context', i.e. windows authentication) and I'm getting error
Login Failed for user NT AUTHORITY\ANONYMOUS LOGIN
, but only when I use it from a client (not when I use it when connected from the server). Double hop anyone?We have a web app set up and as far as I can tell it doesn't function under Kerberos (just prompts for login then fails), but does function under NTLM
Actual Questions
So I'd like to try and work out exactly what SPN's have been lodged in AD but I have two issues/confusions:
Issue 1:
When I type SetSPN -L MyDomain\MyServiceAccount1
I get
Ldap Error(0x22 -- Invalid DN Syntax): ldap_search_s
How do I get around this? Is there an AD browsing tool I can use to enumerate this? I guess it's because there is an invalid character it can't handle (there's a $
in it but surely that's common?)
Issue 2:
When I check the old server I typed these two things:
SetSPN -L ServerNameZ
I get a list of default SPN's, but no SQL Server ones
i.e.
HOST/ServerNameZ
HOST/ServerNameZ.domain.local
When I type SetSPN -L MyDomain\MyOldServiceAccount
I get the SQL Server SPN:
MSSQLSvc/ServerNameZ.domain.local:63267
MSSQLSvc/ServerNameZ.domain.local:COL1
MSSQLSvc/ServerNameZ.domain.local:59082
MSSQLSvc/ServerNameZ.domain.local:COL2
Why doesn't the SQL Server SPN appear in the first server centric list? Isn't that meant to list all SPN's against the server?