can't set spn as domain admin

Question

Hi all,

We have a relatively new CIFS server on a VNX2 which logs "Possible missing SPN detected" on a daily basis so I finally went to add the missing SPN but what I get back is:

SetSpn::getAdminCreds: gss_acquire_cred_ext failed: Miscellaneous failure. Preauthentication failed.

SetSpn::ModifySpn: Failed to get Admin creds for user blah

I have DA and so there should be no problems with rights, I'm wondering if you think this is a bug or is there some secret decoder ring needed to add SPNs? It's running 8.1.9-211 code and we don't see any problems with this SPN missing, but it should be easy to fix this rather than disable the check.

thanks

umichklewis · Answer

As part of the process to create a CIFS server, the CLI commands run on the datamover create an AD object and the associated SPNs. Take a look at the CLI command "server_cifs". There is syntax for adding new SPNs.

Let us know if that helps!

Karl

downhill2 · Answer

Hi Karl,

I discovered after trying it a couple times later in the day it accepted the same command that previously didn’t work, same everything. I knew I had the syntax correct and after adding the missing SPNs, the errors are gone. Now I need to figure out if this was some fluke or if the datamover couldn’t talk to AD correctly or what.

thanks

VNX

can't set spn as domain admin

Was this post helpful?