Tuesday, 29 January 2013

The target principal name is incorrect. Cannot generate SSPI context.

Today's problem occured after I restarted a Hyper-V based SharePoint 2013 farm (Windows Server 2012, one SharePoint 2013 machine, one SQL Server 2012 machine, one DC). I fired up Central Administration and was hit with the following error:

Unknown SQL Exception 0 occurred. Additional error information from SQL Server is included below.

The target principal name is incorrect. Cannot generate SSPI context.

After checking the obvious things - testing connectivity to the DB server, checking the SQL service was running, verifying permissions, etc - I initially figured this was an issue with my Hyper-V snapshots being out of sync, so I ran the SharePoint Products Configuration Wizard. This hit me with the following error:

Failed to detect if this server is joined to a server farm. Possible reasons for this failure could be that you no longer have appropriate permissions to the server farm, the database server hosting the server farm is unresponsive, the configuration database is inaccessible or this server has been removed from the server farm.

I attempted to rejoin the server farm to no avail, then I realised I was barking up the wrong tree. The initial error message suggests a Kerberos issue, while my farm is set up to use NTLM. After a lot of searching, this ancient forum thread pointed me in the right direction. In Active Directory, I opened the computer record for the DB server. In the attribute list, the servicePrincipalName attribute showed the following entries:

























Initially I tried deleting just the MSSQLSvc entries, as suggested by the forum thread, but to no avail. So I deleted the whole lot. With no SPNs, authentication falls back to NTLM as it should and the farm comes back to life.

Update: I'm fairly certain that this issue arose when I added Analysis Services to the SQL Server instance on the database server.

2 comments:

  1. I've just completed an install very similar to yours and found exactly the same problem. This post sorted my problem.

    ReplyDelete
  2. I just read this post and it helped me to determine that I had to remove the two Restricted service principal names as they restrict access to the local server.

    Thanks!!

    ReplyDelete