Domain doesn’t know about my computer account? I vouch for my computer, you can trust me…

Had an issue where a server would not allow logon via termian services each time you attempted to logon it would return this:



Soooooooooo, what to do here? 

First, we made sure the account existed in the directory since that's why it appeared to be complaining.  So I opened LDP and verified it existed, and that all "checked out" with being healthy (stare and compare against a good object).

Second thing we did was crank up netlogon debug logging (nltest dbflag) and see what it showed.  It was complaining of a lot of stuff but nothing conclusive unfortunately.  So at that point it was time to move to event viewer.  The "nice" thing about this issue was that the server was accessible via the network with the same account that was failing to TS so I could do some of the investigation remotely.

One event in particular struck me:

Log Name:      System
Source:        Microsoft-Windows-Security-Kerberos
Date:          7/31/2008 4:11:24 PM
Event ID:      3
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
A Kerberos Error Message was received:
on logon session
Client Time:
Server Time: 23:11:24.0000 7/31/2008 Z
Extended Error: 0xc0000035 KLIN(0)
Client Realm:
Client Name:
Server Realm: braddom.bradforest.COM
Server Name: host/
Target Name: host/
Error Text:
File: 9
Line: d86
Error Data is in record data.

Using err.exe I resolved the error code and found there was a collision:

C:\localbin>err 0xc0000035
# for hex 0xc0000035 / decimal -1073741771 :
  STATUS_OBJECT_NAME_COLLISION                                  ntstatus.h
# Object Name already exists.
# 1 matches found for "0xc0000035"


At this point it's time to look for a collision of "host/" in the forest.  The easiest way to do it is use a nice script called querySPN.vbs.

C:\localbin>querySPN.vbs HOST/
Microsoft (R) Windows Script Host Version 5.7
Copyright (C) Microsoft Corporation. All rights reserved.

CN=VL Account,CN=Users,DC=braddom,DC=bradforest,DC=com
Class: user
User Logon:  VLSBST
-- host/ <-----------------------------------------------------------------  Bingo the SPN is registered for two objects!

Class: computer
Computer DNS:
-- HOST/ <-----------------------------------------------------------------


Once we removed the SPN from the user account, logons began to immediately work.



Comments (5)
  1. Peteski says:

    Dude, you absolutely ROCK! Nice find!

    I’ve been looking for a duplicated SPN for a SQL server for ages and couldn’t find it. In fact, until today I didn’t even know the dup was the problem.

    I didn’t know it was such a problem with SQL and kerberos either.

    Thanks for the useful error messages MS!

  2. Brian says:

    Thank you very much.  AD didn’t handle the renaming of a server well, and left some cruft behind.  Thanks to you, I was able to find and remove it.

  3. Karl says:

    Thanks!!! That is EXACTLY the solution I have been searching for – found a duplicate machine with the SPN stuck on it. Removed the duplicate SPN with ADSI Edit and was immediately able to log in.

  4. tony says:

    Brad, cool trick with the script…but.

    How did you end up with an SPN associated with your user account?  Is that a common happening?

  5. SeasonedVet says:

    Sweet!!! Been working on this issue all day and finally came across this post and fixed. Great catch!! Thanks!

Comments are closed.

Skip to main content