| Previous | Next |
| ERROR_DS_DNS_LOOKUP_FAILURE | ERROR_DS_CANT_RETRIEVE_SD |
ERROR_DS_COULDNT_UPDATE_SPNS
The DNS host-name change could not keep service identities synchronized
Computer and service accounts carry servicePrincipalName values that Kerberos uses to map a service instance to an account. When a computer’s DNS host name changes, Active Directory attempts to maintain related default SPNs. This status means the directory change and its SPN updates could not be completed consistently, often because of permissions, malformed names, or uniqueness constraints.
Read the account’s current dNSHostName and SPN values, then search the forest for duplicates before adding anything manually. Use setspn -S rather than an unchecked add so duplicate detection remains active. Confirm that the caller has rights to update the account and that replication has converged; a duplicate can exist on another domain controller even when a local query appears clean.
What to inspect
- Compare dNSHostName with HOST and RestrictedKrbHost SPNs.
- Search forest-wide for duplicate SPNs.
- Check the directory event log for the value and conflicting object.
References
- Microsoft: configuring service principal names
- Microsoft: setspn duplicate-aware operations
- Microsoft: forest-wide SPN uniqueness
Looking for a different code? Search another status or error code.