You need to identify the setspn.exe command that you must run to configure the appropriate Service Principal Name…

DRAG DROP
You are a network administrator of an Active Directory domain named contoso.com.
You have a server named Server1 that runs Windows Server 2012 R2. Server1 has the Web Server
(IIS) server role installed.
Server1 will host a web site at URL https: //secure.contoso.com. The application pool identity
account of the web site will be set to a domain user account named AppPool1.
You need to identify the setspn.exe command that you must run to configure the appropriate
Service Principal Name (SPN) for the web site.
What should you run?
To answer, drag the appropriate objects to the correct location. Each object may be used once, more
than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

DRAG DROP
You are a network administrator of an Active Directory domain named contoso.com.
You have a server named Server1 that runs Windows Server 2012 R2. Server1 has the Web Server
(IIS) server role installed.
Server1 will host a web site at URL https: //secure.contoso.com. The application pool identity
account of the web site will be set to a domain user account named AppPool1.
You need to identify the setspn.exe command that you must run to configure the appropriate
Service Principal Name (SPN) for the web site.
What should you run?
To answer, drag the appropriate objects to the correct location. Each object may be used once, more
than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

Answer:

Explanation:
Note:
* -s <SPN>
Adds the specified SPN for the computer, after verifying that no duplicates exist.
Usage: setspn –s SPN accountname
For example, to register SPN “http/daserver” for computer “daserver1”:
setspn -S http/daserver daserver1
httpHYPERLINK “http://technet.microsoft.com/en-us/library/cc731241(v=ws.10).aspx#_blank”:
//technetHYPERLINK “http://technet.microsoft.com/en-us/library/cc731241(v=ws.10).aspx#_blank”.
microsoftHYPERLINK “http://technet.microsoft.com/en-us/library/cc731241(v=ws.10).aspx#_blank”.
com/en-us/library/cc731241(v=wsHYPERLINK “http://technet.microsoft.com/enus/library/cc731241(v=ws.10).aspx#_blank”. 10)HYPERLINK “http://technet.microsoft.com/enus/library/cc731241(v=ws.10).aspx#_blank”. aspx
Attn: with Windows 2008 option is -a but with Windows 2012 it started to show -s
Definition of an SPN
An SPN is the name by which a client uniquely identifies an instance of a service. If you install
multiple instances of a service on computers throughout a forest, each service instance must have
its own SPN. A particular service instance can have multiple SPNs if there are multiple names that
clients might use for authentication. For example, an SPN always includes the name of the host
computer on which the service instance is running. Therefore, a service instance might register an
SPN for each name or alias of its host.
Adding SPNs
To add an SPN, use the setspn -s service/namehostname command at a command prompt, where
service/name is the SPN that you want to add and hostname is the actual host name of the
computer object that you want to update. For example, if there is an Active Directory domain
controller with the host name server1.contoso.com that requires an SPN for the Lightweight
Directory Access Protocol (LDAP), type setspn -s ldap/server1.contoso.com server1, and then press
ENTER to add the SPN.
The HTTP service class
The HTTP service class differs from the HTTP protocol. Both the HTTP protocol and the HTTPS
protocol use the HTTP service class. The service class is the string that identifies the general class of
service.
For example, the command may resemble the following command:
setspn –S HTTP/iis6server1. mydomain.com mydomain\appPool1

References:
httpHYPERLINK “http://support.microsoft.com/kb/929650/en-us#_blank”: //supportHYPERLINK
“http://support.microsoft.com/kb/929650/en-us#_blank”. microsoftHYPERLINK
“http://support.microsoft.com/kb/929650/en-us#_blank”. com/kb/929650/en-us
httpHYPERLINK “http://technet.microsoft.com/en-us/library/cc731241(v=ws.10).aspx#_blank”:
//technetHYPERLINK “http://technet.microsoft.com/en-us/library/cc731241(v=ws.10).aspx#_blank”.
microsoftHYPERLINK “http://technet.microsoft.com/en-us/library/cc731241(v=ws.10).aspx#_blank”.
com/en-us/library/cc731241%28v=wsHYPERLINK “http://technet.microsoft.com/enus/library/cc731241(v=ws.10).aspx#_blank”. 10%29HYPERLINK “http://technet.microsoft.com/enus/library/cc731241(v=ws.10).aspx#_blank”. aspx



Leave a Reply 6

Your email address will not be published. Required fields are marked *

8 − 5 =


Sako Pako

Sako Pako

why is not used https/secure.contoso.com? in the question it is mencioned like URL https: //secure.contoso.com

Do anyone know it?

Sako Pako

Sako Pako

Does anyone know it?

screwmicrosoft

screwmicrosoft

That is one of the things about setting SPN you think you should be specifying HTTPS but you don’t I just try to remember no S and only 1 /

Kuba

Kuba

You must specify HTTP service prefix for both http and https sites ex HTTP/hostname. Thing to remember!

Mio

Mio

I agree with you Kuba.

‘The HTTP service class differs from the HTTP protocol. Both the HTTP protocol and the HTTPS protocol use the HTTP service class. The service class is the string that identifies the general class of service’
link:
https://support.microsoft.com/en-us/kb/929650

Gary Trembath

Gary Trembath

To register the http service on the standard port on a computer named CES1 in the corp.contoso.com domain using a service account named CES, use the following command:

setspn -s protocall/servername useraccount
setspn -s http/CES1.corp.contoso.com CORP\CES

setspn -s http/secure.contoso.com apppool1