Windows Server / Active Directory & Group Policy
Inspect Kerberos tickets in the actual service context
A user terminal and a Windows service can hold different tickets and identities. Inspect the relevant context before concluding an SPN change failed.
Environment and inputs: Windows Server 2022 / 2025 baseline · Windows PowerShell with the specified role or RSAT modules; native utilities are identified in the text. Use delegated administration and elevation only where required.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
klistRead the result
In the current Windows logon context, this lists cached Kerberos tickets and timing. It does not show every service account's cache or prove application delegation works.
Resolve and verify
Match the target service principal, account and ticket time with the failed request. Coordinate a bounded reauthentication only after correcting the verified identity or registration issue.
Before changing production
Do not purge all tickets on a production server as a generic fix; active service access can be interrupted.