| Previous | Next |
| ERROR_LICENSE_QUOTA_EXCEEDED | ERROR_MUTUAL_AUTH_FAILED |
ERROR_WRONG_TARGET_NAME
The client requested a security context for the wrong target principal
Kerberos and SSPI bind authentication to a target service name. InitializeSecurityContext can report a wrong principal when the principal receiving authentication is not the same one named by the client, which is a mutual-authentication failure. In Windows deployments, duplicate or misplaced SPNs and services running under an account different from the SPN owner are common causes of target-name failures.
Capture the exact target name passed by the client and the service account actually hosting the endpoint. Query SPN registrations and verify the SPN exists on one correct account. Then inspect service-account password synchronization and Kerberos event 4/KRB_AP_ERR_MODIFIED evidence. Do not disable mutual authentication or force NTLM as the first repair: that can hide an SPN or machine-account problem while weakening authentication. DNS aliases also need the client to construct the intended service principal name.
What to inspect
- Record the exact target principal/SPN requested by the client.
- Verify that SPN is registered once and on the account running the service.
- Correlate Kerberos event 4 and service-account password state before forcing NTLM.
References
- Microsoft: InitializeSecurityContext Kerberos
- Microsoft: Kerberos SPN on wrong account
- Microsoft: KRB_AP_ERR_MODIFIED
Looking for a different code? Search another status or error code.