Can an AD service account host SPNs for multiple SQL Instances? Trying to set up Kerberos Authentication between two linked server to get past the double-hop issue.
Server A is in a domain with several other SQL Servers. All SQL instances on all servers in this domain are using the same service (user) account for running the instance.
Server B is in another domain using a separate domain account to run its instance. It is currently the only SQL server running with a domain account. Other are using local accounts.
I am configuring Server B's service account to allow for self managing SPN's which should be easy. My problem is I will need to do this with Server A's service account as well.
I can't find what I would like to make this clear to me but I am concerned about how Server A's service account will work once I allow it to &quot;self manage&quot; its SPNs i.e. give the AD account read/write ServicePrincipalNames of itself.
Can an AD service account host SPNs for multiple SQL Instances? Currently the account is not hosting any when I query it via setspn -L [domainname]\sqlengine
All SQL servers are running 2008 or higher. Most are 2016.
Yes it can. Eventually If you register too much spns with the same maybe you can fill the ad attribute. SPN is a non-linked-value attribute, and so you run the risk of overrunning the hard-coded 8K limitation within the underlying ESE database.
What you can't do is to share one spn registration with two service accounts.
My suggestion is to take advantage of this tool:
Microsoft® Kerberos Configuration Manager
https://www.microsoft.com/en-us/download/details.aspx?id=39046
Run it (as admin) and it will generate the proper setspn command for kerberos setup.
Eventually you have to register your instances both with netbios &amp; fqdn names.
And please remember that you can register an spn on a domain user account or on a domain coumputer account.