I am trying to figure out what permissions would still be missing if the SPN is created manually for SQL Service account and I am seeing this error message:

The SQL Server Network Interface library could not register the Service Principal Name (SPN) for the SQL Server service. Error: 0x2098, state: 15. Failure to register an SPN may cause integrated authentication to fall back to NTLM instead of Kerberos. This is an informational message. Further action is only required if Kerberos authentication is required by authentication policies.

  • Have you seen mssqltips.com/sqlservertip/2955/… ?
    – Hannah Vernon
    Jun 17 '14 at 4:35
  • In my experience it is well worth taking the time to configure the SQL Server Service Account with the necessary permissions that allow SQL Server to manage the SPNs itself.
    – Hannah Vernon
    Jun 17 '14 at 4:37
  • Also, see dba.stackexchange.com/questions/30121/…
    – Hannah Vernon
    Jun 17 '14 at 4:37
  • Max, you should post that as an answer. Jun 17 '14 at 5:15
  • Yes I have looked at those posts and have created SPN's manually successfully. That's why I am kind of wondering if the SPN's are present without any duplicates why would I get this warning message in SQL error log. Also when I run this statement "select auth_scheme from sys.dm_exec_connections where session_id = @@spid" I get NTLM when executed locally on the server and Kerberos when executed remotely.
    – Vegda
    Jun 17 '14 at 17:37

Browse other questions tagged or ask your own question.