| Previous | Next |
| ERROR_DS_CANT_CREATE_IN_NONDOMAIN_NC | ERROR_DS_FILTER_USES_CONTRUCTED_ATTRS |
ERROR_DS_INVALID_NAME_FOR_SPN
SPN construction failed before uniqueness could be checked
A service principal name identifies a service class and instance, commonly using a host name. When Active Directory derives default SPNs from a computer’s DNS host name, the input must have a syntactically usable host component. Invalid separators, empty labels, unexpected port or service text, and noncanonical host forms can prevent construction of the SPN.
Record the exact host name and intended service class without normalizing them in logs. Compare the account’s dNSHostName with DNS registration and existing SPNs. Use the documented SPN form and setspn tooling rather than concatenating strings in application code. After correcting syntax, still perform a forest-wide uniqueness check; a validly formatted SPN can fail later because another account owns it.
What to inspect
- Validate the DNS host name label by label.
- Separate service class, host, port, and service name components.
- Use setspn -S to add the corrected value with duplicate detection.
References
Looking for a different code? Search another status or error code.