0

Trying to set up Kerberos Authentication between two linked server to get past the double-hop issue.

Server A is in a domain with several other SQL Servers. All SQL instances on all servers in this domain are using the same service (user) account for running the instance. Server B is in another domain using a separate domain account to run its instance. It is currently the only SQL server running with a domain account. Other are using local accounts.

I am configuring Server B's service account to allow for self managing SPN's which should be easy. My problem is I will need to do this with Server A's service account as well.

I can't find what I would like to make this clear to me but I am concerned about how Server A's service account will work once I allow it to "self manage" its SPNs i.e. give the AD account read/write ServicePrincipalNames of itself.

Can an AD service account host SPNs for multiple SQL Instances? Currently the account is not hosting any when I query it via setspn -L [domainname]\sqlengine

All SQL servers are running 2008 or higher. Most are 2016.

2
  • 2
    Please not that this "All SQL instances on all servers in this domain are using the same service (user) account for running the instance" is not a good idea. And for modern versions of SQL Server you should choose between Virtual Accounts and Managed Service Accounts. docs.microsoft.com/en-us/sql/database-engine/configure-windows/… – David Browne - Microsoft Feb 11 at 20:09
  • @DavidBrowne-Microsoft Not an excuse but I was trying to get away from local accounts and this was a step in the right direction. I should have went farther. I have been looking into MSAs. Just need to find a meaningful name to associated it to the server and still stay under 15 characters. – Matt Feb 11 at 22:36
1

Yes it can. Eventually If you register too much spns with the same maybe you can fill the ad attribute. SPN is a non-linked-value attribute, and so you run the risk of overrunning the hard-coded 8K limitation within the underlying ESE database.

What you can't do is to share one spn registration with two service accounts.

My suggestion is to take advantage of this tool: Microsoft® Kerberos Configuration Manager https://www.microsoft.com/en-us/download/details.aspx?id=39046

Run it (as admin) and it will generate the proper setspn command for kerberos setup. Eventually you have to register your instances both with netbios & fqdn names.

And please remember that you can register an spn on a domain user account or on a domain coumputer account.

1
  • I think I should take the opportunity to do use the MSA accounts and make dedicated ones for each instance. Its good to know that I could have done this though. Thanks. – Matt Feb 12 at 1:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.