Zurück
-
Titel
SPN error messages in status output after a join when DNS does not match Kerberos Realm -
Beschreibung
SPN error messages in status output after a join when DNS does not match Kerberos Realm
Example errors in status output:
--------------------------
WARNING: Did not find SPN <host/host001.prod.domain.com> in list of SPNs <as/HOST001 host/HOST001 >
WARNING: 501 The computer object is missing servicePrincipalName entry(s).
WARNING: Did not find keytab SPN <host/host001.prod.domain.com> in list of AD SPNs <as/HOST001 host/HOST001 >
WARNING: 503 host.keytab has SPN entries that are not in AD.
--------------------------Note that the DNS is prod.domain.com
However the Kerberos REALM is DOMAIN.COM
The dnshostname entry for the computer object will also be missing:
/opt/quest/bin/vastool -u host/ attrs host/ dnshostname -
Ursache
The join was performed by a delegated user who does not have permissions to set a mismatched SPN. -
Lösung
Check the delegated permissions for the join user, or perform the join using a domain administrator.
A domain administrator will have permissions to set an SPN that has a mismatched suffix.