Kerberos Configuration Manager for SQL Server is available

Applies to: SQL Server 2012 Analysis ServicesMicrosoft SQL Server 2005 Developer EditionMicrosoft SQL Server 2005 Enterprise Edition

This article describes the Microsoft Kerberos Configuration Manager diagnostic tool for SQL Server. This tool is available for download from the Microsoft Download Center: 

Download Download the package now.

About Kerberos Configuration Manager


The Kerberos Configuration Manager for SQL Server is a diagnostic tool that helps troubleshoot Kerberos related connectivity issues with SQL Server, SQL Server Reporting Services (SSRS), and SQL Server Analysis Services (SSAS). It can perform the following functions:

  • Collect information about operating system (OS), Microsoft SQL Server instances, and Always On Availability Group Listeners installed on a server.
  • Report all Service Principal Name (SPN) and delegation configurations on the server.
  • Identify potential problems in SPNs and delegations.
  • Fix potential SPN problems.

More Information



This tool helps troubleshoot the following exceptions:
  • 401
    Note This error message is for http errors, SSRS errors, and some other similar errors.
  • Login failed for user 'NTAUTHORITY\ANONYMOUS'
  • Login failed for user '(null)'
  • Login failed for user ''
  • Cannot generate SSPI Context

For more information about Kerberos Configuration Manager, go to the following related blog:

SQL Server Release Services: Kerberos Config Tool

To Start the Tool:

  1. After the installation is complete successfully, double-click KerberosConfigMgr.exe to start the application.
  2. To troubleshoot the connectivity issue with SQL Server, connect to the destination computer by using a domain user account that has user permissions to that computer.
  3. To troubleshoot the connectivity issue with SSRS, connect to the destination computer by using a domain user account that has administrative permissions to that computer.


To Generate the SPN List from the Command Line:

  1. Go to the command line. (Note: To troubleshoot the connectivity issue with SSRS, start the command line window as administrator.)
  2. Switch to the folder where KerberosConfigMgr.exe is.
  3. Type KerberosConfigMgr.exe -q -l
  4. For more command-line option, type KerberosConfigMgr.exe -h


To Save a Server's Kerberos Configuration Information:

  1. Connect to the target windows server.
  2. Click the Save button on the toolbar.
  3. Specify the location where you want the file to be saved. It can be on a local drive or a network share.
  4. The file will be saved as the .XML format.


To View a Server's Kerberos Configuration Information from the Saved File:

  1. Click the Load button on the toolbar.
  2. Open the XML file generated by Kerberos Configuration Manager.


To Generate a Script to Fix the SPN from the Command Line:

  1. Click the Generate button for the SPN entry.
  2. The generated script can be used by a user who has permissions to fix the SPN on the server.


To See the Log Files for This Tool:

By default, one log file is generated every time that the application is run in the user's application data folder: %APPDATA%\Microsoft\KerberosConfigMgr.


To Get Help:

Option 1: Hover the pointer over the command for tooltip.

Option 2: Run KerberosConfigMgr.exe –h from the command line.

Option 3: Click the Help button in the toolbar.