Troubleshoot Kerberos authentication and single sign-on failures by checking DNS, SPNs, service accounts, tickets and time synchronization.
01

Confirm the expected authentication path

First identify the client, service endpoint, service account and expected SPN. A Kerberos failure can be caused by infrastructure problems or an incorrect or duplicate service principal name.

02

Check DNS before SPNs

Kerberos depends on correct naming. Verify forward and reverse resolution where relevant and confirm that clients resolve the service name to the intended host. Do not troubleshoot SPNs while DNS is still wrong.

03

Inspect SPNs

Use setspn -Q to search for an SPN and setspn -L to inspect the account associated with a service. Duplicate SPNs can cause the KDC to issue tickets for the wrong account.

04

Inspect the client's tickets

Use klist to view cached Kerberos tickets. After correcting an account or SPN, purge stale tickets with klist purge and reproduce the issue.

05

Check time and identity

Kerberos is sensitive to time skew. Confirm the client, server and domain controllers have a healthy time hierarchy. Also verify that the service is actually running under the account you are inspecting.

06

Resolution order

DNS → service identity → SPN uniqueness → ticket cache → time → application configuration. Avoid deleting SPNs until you know which account should own the service identity.

Useful commands

setspn -Q HTTP/server.example.com
setspn -L DOMAIN\svcWeb
klist
klist purge
w32tm /query /status
Production checklist: capture the original state, test one dependency at a time, make the smallest controlled change and validate the original symptom before closing the incident.
07

What good troubleshooting looks like

Use evidence before configuration changes. Record the symptom, test result, change made and validation result so another engineer can repeat the procedure.

Workflow
Symptom → hypothesis → direct test → controlled change → validation → documentation
08

Frequently asked questions

What should I check first?

Start with the exact failed path or dependency and test it directly before changing configuration.

Should I change production configuration immediately?

No. Capture the current state first and make one controlled change at a time.

How should I document the fix?

Record the symptom, commands, result, configuration change and validation result.

09
Windows Server SMB Troubleshooting: Share Access, Ports and Performance →MABS System State and BMR Backup Troubleshooting →PowerShell Remoting and WinRM: Production Troubleshooting Checklist →
10

Primary reference

This guide was independently written for TechRunbook. Technical details were checked against current Microsoft documentation. Microsoft Learn reference →

Need more infrastructure runbooks?

Explore the TechRunbook article library for Windows Server, VMware, Hyper-V, Azure, PowerShell and MABS troubleshooting.

Browse all articles →

Explore more TechRunbook guides

Browse practical troubleshooting guides, PowerShell scripts, checklists and infrastructure resources for your environment.

Browse all articles →
TechRunbook · Practical infrastructure knowledge, ready when it matters.