SPN registered incorrectly during ADFS setup when you use gMSA service account

  • Article

On Windows 2012 R2, when you when you use group Managed Service Account (gMSA) service account, you may come accros this problem during setup of the first ADFS servers in the farm or during setup of the additional ADFS servers in the farm. You can also apply the same solution for normal service accounts that are barely domain user accounts, if you notice the same problem.

Service Principal Names (SPNs) registered incorrectly

The solution I applied is simple. You just need to create the missing SPN records for the ADFS service account. That is it!

setspn -s http/adfsdonaminname addomain\ADFSserviceaccount$

setspn -s http/fs.contoso.com contoso\ADFSsvc$ setspn -s host/adfsdonaminname addomain\ADFSserviceaccount$

setspn -s host/fs.contoso.com contoso\ADFSsvc$