demo

One session, start to finish.

A scripted walkthrough of a real session: SQL Server Engine on a host where the SPN is on the machine account. Hostnames and account names are illustrative; the command output shapes are the product's.

The symptom

Applications connecting to sql01 report Cannot generate SSPI context for some users. From the DBA's session, auth_scheme says NTLM.

SQL Server

SELECT auth_scheme FROM sys.dm_exec_connections WHERE session_id = @@SPID;NTLM

Sense

The provider reads the instance, port, and service account from the machine.

Invoke-SpnLifecycle -ProviderId SQL.Engine -TargetComputer sql01 -WhatIf -VerboseVERBOSE: Sense   MSSQLSERVER on sql01, TCP 1433, runs as CORP\svc_sql

Plan

Four strings. FQDN and NetBIOS, with and without port.

VERBOSE: Propose 4 SPNs for CORP\svc_sql  MSSQLSvc/sql01.corp.example.com:1433  MSSQLSvc/SQL01:1433  MSSQLSvc/sql01.corp.example.com  MSSQLSvc/SQL01

Test

The preflight finds the cause: the SPN already exists on the machine account.

VERBOSE: Test    ACL write on CN=svc_sql: okVERBOSE: Test    duplicate scan: 1 conflict  MSSQLSvc/sql01.corp.example.com:1433  held by  SQL01$VERBOSE: Plan is not executable until the conflict is resolved.

Resolve and execute

Remove from the machine account, add to the service account. Both writes are confirmed.

$plan | Invoke-SpnExecutionEngine -Mode Remove -Confirm   # from SQL01$$plan | Invoke-SpnExecutionEngine -Mode Add -Confirm      # to svc_sqlConfirm: Add SPN MSSQLSvc/sql01.corp.example.com:1433 to CN=svc_sql? [Y] Yes# run-id, module 0.4.0, commit, timestamp recorded

Prove

A client reconnects. The oracle reads the mechanism. The baseline was NTLM, so a Kerberos result is a Pass.

	before	after	oracle 2	verdict
sql01 / SqlAuthScheme	NTLM	KERBEROS	agrees	PASS

This page is static by design. A recorded session ({{ tok.DEMO_RECORDING_URL }}) can sit above it when one exists; the transcript stays as the accessible version.