| Previous | Next |
| ERROR_DS_NOT_CLOSEST | ERROR_DS_SINGLE_USER_MODE_FAILED |
ERROR_DS_CANT_DERIVE_SPN_WITHOUT_SERVER_REF
ERROR_DS_CANT_DERIVE_SPN_WITHOUT_SERVER_REF (8589) is an Active Directory Domain Services error. The directory service needed to derive a Service Principal Name for mutual authentication but the local server object has no serverReference attribute. This is usually a domain-controller topology or metadata consistency problem rather than an SPN-string typo.
What to check
- Inspect the affected server and computer objects in the configuration and domain partitions.
- Check for incomplete promotion, interrupted demotion, or stale DC metadata.
- Verify existing SPNs, but do not manufacture serverReference values by hand.
Useful command
setspn -L "<ComputerAccount>"Microsoft: Configure Service Principal Names · Microsoft: Clean up AD DS server metadata · Microsoft: Diagnose AD replication failures
Looking for a different code? Search another status or error code.