kerberos tickets and the SPNs

Douglas E. Engert deengert at
Mon May 11 14:36:02 EDT 2009

Markus Moeller wrote:
> I use also msktutil and you can find it here 

That points to:
and Finley is here at ANL.

We now have Debian mods to 0.3.16-7  to work with W2008, and use the
Windows attribute msDs-supportedEncryptionTypes so one can use AES.
Any one interested?

> You can also use setspn -A host/fqdn in lowercase. instead of setspn -R.
> BTW the original netjoin tool from MS used computer accounts not user 
> accounts.
> I don't know why they changed their mind.
> Markus
> ----- Original Message ----- From: "Ravi Channavajhala" 
> <ravi.channavajhala at>
> To: "Douglas E. Engert" <deengert at>
> Cc: "Markus Moeller" <huaraz at>; <kerberos at>
> Sent: Friday, May 08, 2009 8:59 PM
> Subject: Re: kerberos tickets and the SPNs
> Don't agree here.  Natively adding a computer to AD and checking with
> setspn -L didn't show any SPNs.  Resetting the SPNs with setspn -R,
> creates two entries
> Both are incorrect....
> The point is, I can manipulate SPNs to no end, but obviously no
> success with Kerberos. My real issue is kerberos flip flopping with
> 'Server not found in Database' to 'Keytable entry incorrect Key
> version'.


  Douglas E. Engert  <DEEngert at>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444

More information about the Kerberos mailing list