I have a question about how to manually set SPN for using Kerberos authentication on a SQL cluster.

Do I set one SPN on the clustername or one on each node? enter image description here

I also have a default named instance, do i specify the name of the instance?


To create a SPN for a SQL FCI, use the FQDN of the FCI instance. For example, if the FCI name is "SQLFCI1" on the contoso domain and it listens on port 22000 with domain account SQLSvcAcct then the spn would be: setspn -s MSSQLSvc/SQLFCI1.contoso.com:22000 Contoso\SQLSvcAcct

If you don't want to deal with doing this by hand there is a great tool provided by Microsoft for this.

  • Thank you for the reply, just to be sure, in my case its: DBCLI01.domain.. as on the picture in my question?
    – hanness
    Nov 9 '16 at 12:28
  • Your picture doesn't show any pertinent information needed for the question. The domain is removed and we can't see the client access point in the FCI role (as nodes are on the screen). Nov 9 '16 at 14:56
  • Okey, where do I find the "SQLFCI1"-part in your reply? I have only masked the domain.
    – hanness
    Nov 10 '16 at 15:24
  • This is the network name that you would connect to. What do you type into SSMS to connect? What is the client access point name in the role in failover cluster manager for this installation of SQL Server. These will be the same value. Nov 10 '16 at 16:35
  • Perfect, got it!
    – hanness
    Nov 10 '16 at 20:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.