| Previous | Next |
| ERROR_INCORRECT_ACCOUNT_TYPE | ERROR_DS_UPN_VALUE_NOT_UNIQUE_IN_FOREST |
ERROR_DS_SPN_VALUE_NOT_UNIQUE_IN_FOREST
Kerberos service identity is duplicated forest-wide
An SPN maps a service instance to the account whose key Kerberos should use. If the same value is assigned to more than one account, a client cannot reliably select the correct key and authentication can fail. Modern domain controllers block additions, modifications, renames, and restores that would create a duplicate forest-wide SPN.
Search the entire forest with setspn -Q or -X -F, then compare every returned object with the service’s real run-as account. Remove or correct stale registrations rather than forcing the new value with an unchecked method. Review Directory Service event 2974 on the DC that rejected the write; it can list the blocked value and conflicting objects. Allow replication to converge before retrying.
What to inspect
- Search the forest for the exact normalized SPN.
- Verify which account actually runs the service.
- Use setspn -S for duplicate-aware registration.
References
- Microsoft: SPN and UPN uniqueness
- Microsoft: setspn query and duplicate detection
- Microsoft: configuring SPNs
Looking for a different code? Search another status or error code.