New features in SETSPN.EXE on Windows Server 2008

The version of Setspn.exe that came with Microsoft Windows Server 2000/2003 Support Tools did not have features to detect duplicate SPNs. The new version of Setspn.exe that comes bundled with Windows Server 2008 utilities has some really cool features. For someone dealing with the dreaded Kerberos authentication failure issues on a daily basis like me it’s a sigh of relief.

If you try the following command on the Windows Server 2008 you will see the various new options (or switches) available.


Notice the modifiers/switches:

-F = perform the duplicate checking on forestwide level

-S = add arbitrary SPN after verifying no duplicates exist

-Q = query for existence of SPN

-X = search for duplicate SPNs


Searching for duplicate SPNs using Setspn.exe:

D:\>setspn -X http/
Processing entry 0
http/ is registered on these accounts:
CN=<IIS-servername>,OU=Domain Controllers,DC=<some-DC-primary>,DC=<some-DC-secondary>

found 1 group of duplicate SPNs.

Searching for the existence of an SPN in the domain:

D:\>setspn -Q http/
CN=<IIS-servername>,OU=Domain Controllers,DC=<some-DC-primary>,DC=<some-DC-secondary>

Existing SPN found!

Adding an arbitrary SPN after verifying no duplicates exist in the domain:

D:\>setspn -S http/ <IIS-servername>

Duplicate SPN found, aborting operation!

Adding an arbitrary SPN after verifying no duplicates exist in the forest:

D:\>setspn -F -S http/ <IIS-servername>
Operation will be performed forestwide, it might take a while.

Duplicate SPN found, aborting operation!

So what does this mean? It means you no longer have to depend upon boggling commands using LDIFDE or your own custom scripts to find out the duplicate SPNs. This is a good news indeed!

*Prior to this using Windows Server 2000/2003 Support Tools we could use commands using LDIFDE to find duplicate SPNs as below:


ldifde -f <filename> -d “<dc=domain-netbiosname,dc=primary-domain>” -l serviceprincipalname -r “(serviceprincipalname=<serviceprincipalname-to-check-for-duplicates>)” -p subtree

For example, if the domain name is and the site URL is http// command should be as shown below:

ldifde –f C:\log.txt -d “dc=test, dc=abcd, dc=com”-l serviceprincipalname –r “(serviceprinicpalname=http/” -p subtree

With the newer version of Setspn hopefully the dependency on the above command should reduce drastically.

Till next time,


Comments (4)

  1. Saur212 says:

    An update for setspn for win2k3 is available now

  2. This is great information. Just FYI, we have our SetSPN guidance now on the TechNet Wiki…/717.service-principal-names-spns-setspn-syntax-setspn-exe.aspx

  3. Farhan says:


    Lets say after finding out the duplicate SPN reveals the following >> MSSSQLSvc/<domain controller name>.<domain>.local

    Then how does one delete it or update the existing account which is using the same spn?