I have a question about how to manually set SPN for using Kerberos authentication on a SQL cluster.

Do I set one SPN on the clustername or one on each node? enter image description here

I also have a default named instance, do i specify the name of the instance?

1 Answer 1


To create a SPN for a SQL FCI, use the FQDN of the FCI instance. For example, if the FCI name is "SQLFCI1" on the contoso domain and it listens on port 22000 with domain account SQLSvcAcct then the spn would be: setspn -s MSSQLSvc/SQLFCI1.contoso.com:22000 Contoso\SQLSvcAcct

If you don't want to deal with doing this by hand there is a great tool provided by Microsoft for this.

  • Thank you for the reply, just to be sure, in my case its: DBCLI01.domain.. as on the picture in my question?
    – hanness
    Commented Nov 9, 2016 at 12:28
  • Your picture doesn't show any pertinent information needed for the question. The domain is removed and we can't see the client access point in the FCI role (as nodes are on the screen). Commented Nov 9, 2016 at 14:56
  • Okey, where do I find the "SQLFCI1"-part in your reply? I have only masked the domain.
    – hanness
    Commented Nov 10, 2016 at 15:24
  • This is the network name that you would connect to. What do you type into SSMS to connect? What is the client access point name in the role in failover cluster manager for this installation of SQL Server. These will be the same value. Commented Nov 10, 2016 at 16:35
  • Perfect, got it!
    – hanness
    Commented Nov 10, 2016 at 20:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.