setspn

The setspn command line utility reads, modifies, and deletes the Service Principal Names (SPN) directory property for an Active Directory (AD) service account. You use SPNs to locate a target principal name for running a service. You can use setspn to view the current SPNs, reset the account's default SPNs, and add or delete supplemental SPNs. Setspn is available if you have the Active Directory Domain Services (AD DS) server role installed. Setspn must be ran through an elevated command prompt. Query Mode modifiers can be used with the -S switch in order to specify where the check for duplicates should be performed before adding the SPN. - -T can be specified multiple times. To indicate the current domain or a forest, use "" or *. - -Q executes on each target domain or forest. - -X returns duplicates that exist across all targets. SPNs aren't required to be unique across forests, but duplicate SPNs can cause authentication issues during cross-forest authentication. - SPNs must be constructed using the base name of the account specified as the _accountname_ parameter. If this condition isn't met, the directory service returns a constraint violation error. You might not have the rights to access or modify this property on some account objects. You can determine what your access rights are by viewing the security attributes of the account object using the Microsoft Management Console (MMC) in Active Directory Users and Computers. You can also delegate the permission by assigning the Validated write to service principal name permission to the desired user or group. The built-in SPNs that are recognized for computer accounts are: These SPNs are recognized for computer accounts if the computer has a host SPN. Unless they're explicitly placed on objects, a host SPN can substitute for any of the mentioned SPNs. SPNs aren't case sensitive when used by Microsoft Windows-based computers. Any type of computer system can use an SPN. Many of these computer systems, especially UNIX-based systems, are case-sensitive, and require the proper case to function properly. Care should be taken to use the proper case particularly when an SPN is used by a non-Windows-based computer.

setspn <modifiers switch> <accountname> [-R] [-S] [-D] [-L] [-C] [-U] [-Q] [-X] [-P] [-F] [-T] [-?] [/?]