If the connection string does not contain the SSPI=Kerberos parameter, Kerberos authentication is typically used. The connection to the SQL Server Browser service uses NTLM and the NT_ANONYMOUS account instead. In this case, the connection to the SQL Server Browser service is successful. The SQL Server Browser service determines the correct port. Then, the actual database connection uses Kerberos authentication to provide the true authentication.
The format of a NetBIOS SPN is as follows:
How to Register SPNYou must be a member of the Domain Administrators group to run the Setspn command.
To create the SPN for the Browser Service that is running under Domain Account, run the following commands at a command prompt:
Setspn.exe -a MSOLAPDisco.3/serverHostName Browser_Service_Startup_Account
To verify SPNWhen the service is running under a Domain account:
Article ID: 950599 - Last Review: Jan 16, 2014 - Revision: 1