How to fix the target principal name is incorrect cannot generate sspi context?

How to fix the target principal name is incorrect cannot generate sspi context?

There are 3 ways to fix the problem:

1. Revert to using the Network Service or Local System account (NOT RECOMMENDED)
2. Assign the domain account to the Domain Admins group (NOT IDEAL – due to the elevated permissions)
3. Fix the problem by giving the domain account just the appropriate permissions in Active Directory.

Can not generate SSPI context SQL?

The “Cannot generate SSPI context” error is generated when SSPI uses Kerberos authentication to delegate over TCP/IP and Kerberos authentication cannot complete the necessary operations to successfully delegate the user security token to the destination computer that is running SQL Server.

How do I use setspn?

To use setspn, you must run the setspn command from an elevated command prompt. To open an elevated command prompt, click Start, right-click Command Prompt, and then click Run as administrator. For examples of how to use this command, see Examples. It is not usually necessary to modify SPNs.

What does it mean the target principal name is incorrect?

This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using.

Is not accessible the target account name is incorrect?

Another reason you can get the “target account name is incorrect” error is if a domain controller was recently migrated from a parent domain to a child domain. Another way to fix it is to remove the server from the domain and rejoin it back to the domain so that the computer account gets reset.

How do I set up Sspi?

The setup steps are as follows:

1. Identify Administrative Account.
2. Log in to pgAdmin 4.
3. Create Administrative Account in Postgres.
4. Open File Explorer to C:\Program Files\PostgreSQL\11\data.
5. Edit pg_ident. conf.
6. Modify pg_hba. conf.
7. Reload Postgres Configuration.
8. Confirm SSPI.

How do I know if my SPN is correct?

Verify SPN has been successfully registered Using SETSPN Command Line Utility. In Command Line enter the following command: setspn -L and press enter. Next, you need to look for registered ServicePrincipalName to ensure that a valid SPN has been created for the SQL Server.

Why does SQL Server say cannot generate SSPI context?

“The target principal name is incorrect. Cannot generate SSPI context.” The explanation, as given by Microsoft in this KB article. If you run the SQL Server service under the LocalSystem account, the SPN is automatically registered and Kerberos authentication interacts successfully with the computer that is running SQL Server.

Is the target principal name in SQL Server incorrect?

SQL Server / The target principal name is incorrect. Cannot generate SSPI context One of our old SQL servers was running under the local system context. Then we decided to change the account that the SQL service runs under, and we created domain service account with basic domain user permissions.

What does SSPI context error mean for Kerberos?

The SSPI context error definitely indicates authentication is being attempted using kerberos. Check the security event logs, if you are using kerberos you should see logon attempts with authentication package: Kerberos.

Why is MY SQL Server not registering SPN?

The SQL Server Network Interface library could not register the Service Principal Name (SPN) [ MSSQLSvc/servername.domainname.net:1433 ] for the SQL Server service. Windows return code: 0x2098, state: 15.