This article was previously published under Q321044
The following events may be recorded in the System log on one or more domain controllers:
Event Type: Error Event Source: KDC Event Category: None Event ID: 11 Date: 4/1/2002 Time: 1:40:14 PM User: N/A Computer: ComputerName Description: There are multiple accounts with name host/mycomputer.mydomain.com of type10.
Event Type: Error Event Source: KDC Event Category: None Event ID: 11 Date: 8/17/2004 Time: 1:30:00 PM User: N/A Computer: ComputerName Description: There are multiple accounts with name HOST/machinename of type DS_SERVICE_PRINCIPAL_NAME.
Event Type: Error Event Source: Kerberos Event Category: None Event ID: 4 Date: 8/17/2004 Time: 1:30:00 PM User: N/A Computer: ComputerName Description: The kerberos client received a KRB_AP_ERR_MODIFIED error from the server host/machinename.childdomain.rootdomain.com. The target name used was cifs/machinename.domain.com. This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically named machine accounts in the target realm (childdomain.rootdomain.COM), and the client realm. Please contact your system administrator.
This event may also apply to other service principal names. For example, this event may also apply to host/NetBIOSComputerName.
This problem occurs because two or more computer accounts have the same service principal name (SPN) registered. Event ID 11 is logged when the Key Distribution Center (KDC) receives a ticket request, and the related SPN exists more than one time when it is checked on the global catalog (GC) for forestwide verification.
To resolve this problem, locate the computer accounts that have the duplicate SPNs. When you have located the computers that have the duplicate SPNs, you can either delete the computer account from the domain, disjoin and rejoin the computer to the domain, or you can use ADSIEdit to correct the SPN on the computer that has the incorrect SPN.
To locate the computer accounts that have the duplicate SPNs, use one of the following methods.
Method 1: Use the LDP support tool
Note If you do not have the Windows 2000 support tools installed, install them from the Windows 2000 CD-ROM before you continue. The Setup executable file for the support tools is located on the CD-ROM in the Support\Tools folder. The installation does not require that you restart the computer. However, you may have to restart the computer to update the environment variables.
Click Start, click Run, type LDP, and then click OK.
Click Connection, and then click Connect.
Leave the default settings, and then click OK.
Note If you do not receive the expected result, try another search by using the Global Catalog Port (3268) instead of the default setting (389).
Click Connection, and then click Bind.
Leave the default settings, and then click OK.
Click View, and then click Tree.
In the Tree View dialog box, type DC=YourDomain,DC=com in the BaseDN box, where YourDomain is your domain.
Click Browse, and then click Search.
In the Search dialog box, type DC=YourDomain,DC=com in the BaseDN box.
In the Search dialog box, type (serviceprincipalname=HOST/mycomputer.mydomain.com)in the Filter box. If the service principal name that is referred to in the error in the System log differs from this example, type the service principal name to which the error refers.
Note If you do not receive the expected result, try searching for " HOST/" as opposed to searching only for the exact SPN in the event ID.
Under Scope, click Subtree.
Method 2: Use the Ldifde utility
Use the Ldifde utility to dump the SPN for the forest:
From the domain controller, open a command prompt, and then type the following string:
(Note Because you use the -t 3268 parameter to specify that a global catalog (GC) server is used in the query, and you do not use the -d parameter to specify an explicit distinguished name (DN), the forest root DN is used with the HOST/mycomputer* parameter. Therefore, you can look for all SPNs that contains this string.
Open the check_SPN.txt file in Notepad, and then search for the SPN that is reported in the event log.
Note the user accounts and the computer accounts under which the SPN is located.
Use the querySpn.vbs script in the following Microsoft TechNet article. To use the script, copy the code, paste it into Notepad, and then save the script as querySpn.vbs.
Microsoft Windows Server 2003, Standard Edition (32-bit x86), Microsoft Windows Server 2003, Enterprise Edition (32-bit x86), Microsoft Windows Server 2003, Datacenter Edition (32-bit x86), Microsoft Windows 2000 Server SP2, Microsoft Windows 2000 Server SP1