Unable to remove invalid(orphaned?) SPNs
- by Brent
tldr version: Renamed domain from internal.domain.com to domain.com, have 4 SPNs that am unable to remove from DC.
So my domain was internal.domain-name.com and I renamed it to domain-name.com and I thought everything was good. Several days later, I start setting up my RD Gateway and am noticing issues surrounding group policy. I run dcdiag and the SystemLog part fails.
Starting test: SystemLog
A warning event occurred. EventID: 0x00001796
Time Generated: 08/25/2014 02:48:30
Event String:
Microsoft Windows Server has detected that NTLM authentication is presently being used between clients and this server. This event occurs once per boot of the server on the first time a client uses NTLM with this server.
An error event occurred. EventID: 0xC0001B70
Time Generated: 08/25/2014 02:49:18
Event String:
The SQL Server (MSSQLSERVER) service terminated with the following service-specific error:
An error event occurred. EventID: 0xC0001B70
Time Generated: 08/25/2014 02:49:48
Event String:
The SQL Server (MSSQLSERVER) service terminated with the following service-specific error:
An error event occurred. EventID: 0xC0001B70
Time Generated: 08/25/2014 02:52:47
Event String:
The SQL Server (MSSQLSERVER) service terminated with the following service-specific error:
This made me check my AD for possible connections to the .internal domain. I found four which I remove by:
setspn -D E3514235-4B06-11D1-AB04-00C04FC2DCD2/d79fa59c-74ad-4610-a5e6-b71866c7a157/internal.domain-name.com ServerName
setspn -D HOST/ServerName.domain-name.com/internal.domain-name.com ServerName
setspn -D GC/ServerName.domain-name.com/internal.domain-name.com ServerName
setspn -D ldap/ServerName.domain-name.com/internal.domain-name.com ServerName
Also, checking my dns records, there's an internal subdomain that I can delete but it comes back as well. I've tried removing the spns to no avail. Is there something I'm missing?
