title: Windows authentication 401 error, SPN to Service account
body: <p>I'm struggling around and hope you can help me.</p>
  
  <p>Scenario:
  I wrote a web application on a test server and all works fine. I moved the finished application to the live system and I receive a HTTP 401 error if windows authentication is enabled on IIS. I solved this problem by setting an SPN on server name e.g. </p>
  
  <p><code>setspn -a http/contoso contoso</code></p>
  
  <p>But it needs to work with my service account.
  I set spn for service account like:  </p>
  
  <p><code>setspn -a http/contoso.com mydomain\serviceaccount
   setspn -a http/contoso mydomain\serviceaccount</code></p>
  
  <p>Application pool is running as mydomain\serviceaccount. The Kerberos Delegation is set for this account in Active Directory. But still get a 401 error.  For testing purposes, the service account has the Administrator role on this server.</p>