Ronald de Kock

When installing a SQL 2008 Server Failover Cluster it is necessary to create SPN’s for the SQL Server Service Account. One way to accomplish this is to tweak the Service User Account used for running the SQL Server. The permissions of the Service Account can to be adjusted to allow it to create and remove SPN’s.

Use ADSI Edit (included in Server 2008) and connect to the Default Naming Context.
Locate the Service Account, open the security tab.
Select SELF in the group or user names windows and check the Allow box for  ”Write public information” .

After making the change restart the SQL Server service. The Service Account will register the SPN automatically.

To check if the SPN’s are registered correctly open a command prompt and do:
setspn -L Serviceaccount (e.g. SA_SQL2008_01)

The output should look like:
Registered ServicePrincipal Names for CN=SA_SQL2008_01, OU=Service Accounts, DC=Contoso, DC=com

MSSQLSvc/FQDN:1433

Works like a charm.

This entry was posted on Wednesday, March 3rd, 2010 at 20:32 and is filed under SQL Server. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.