Failed to create Keytab file with error "Failed to set property 'userPrincipalName'"

Failed to create Keytab file with error "Failed to set property 'userPrincipalName'"

book

Article ID: KB0077040

calendar_today

Updated On:

Products Versions
Spotfire Server All Versions

Description

Failed to create keytab file with  below error returned:
-------------
ktpass /princ HTTP/spotfireserver.research.example.com@RESEARCH.EXAMPLE.COM  /ptype krb5_nt_principal /crypto aes128-sha1 /mapuser spotsvc  /out spotfire.keytab -kvno 0 /pass spotsvcpassword
--------------
Targeting domain controller: research.example.com
Failed to set property 'userPrincipalName' to 'HTTP/spotfireserver.research.example.com@RESEARCH.EXAMPLE.COM' on Dn 'CN= spotsvc,CN=Users,DC=research,DC=example,DC=com': 0x13.

WARNING: Failed to set UPN HTTP/spotfireserver.research.example.com@RESEARCH.EXAMPLE.COM on CN=spotsvc,CN=Users,DC=research,DC=example,DC=com.
  kinits to 'HTTP/spotfireserver.research.example.com@RESEARCH.EXAMPLE.COM' will fail.
Successfully mapped HTTP/spotfireserver.research.example.com to spotsvc.
Password successfully set!

Issue/Introduction

Failed to create Keytab file with error "Failed to set property 'userPrincipalName'"

Resolution

  • Check whether the UAC is enabled on the server which you run the command on, if yes, please have a try to take that same command and run it on the same server after disabling UAC and rebooting server, then see if the warning is gone.
  • In addition, make sure that the account which is used to run the command is from a member of Domain Admins, Schema Admins, Enterprise Admins, and the built-in Administrators group.
  • If the above doesn't work, check if there are duplicate accounts with the same UserPrincipalName. You can try running the ktpass command with the shortname e.g
------------
ktpass /princ HTTP/spotfireserver@RESEARCH.EXAMPLE.COM  /ptype krb5_nt_principal /crypto aes128-sha1 /mapuser spotsvc  /out spotfire.keytab -kvno 0 /pass spotsvcpassword
------------