Windows Server / Active Directory & Group Policy
Find an SPN registration before changing Kerberos configuration
A service may fail Kerberos when its SPN is absent, duplicated or assigned to the wrong identity. Start with a precise query.
Environment and inputs: Windows Server 2022 / 2025 baseline · Windows PowerShell with the specified role or RSAT modules; native utilities are identified in the text. Use delegated administration and elevation only where required.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
setspn -Q HTTP/web01.corp.example.comRead the result
The command queries registration of the example service principal name. Replace it with the exact SPN required by the failing client flow.
Resolve and verify
Compare the returned account with the actual service identity and supported SPN design. Correct duplicate or misplaced registration through the directory owner.
Before changing production
Do not delete or register guessed SPNs. A change can affect every client using that service name.