Unable to remove invalid(orphaned?) SPNs

Posted by Brent on Server Fault See other posts from Server Fault or by Brent
Published on 2014-08-25T08:41:02Z Indexed on 2014/08/25 10:21 UTC
Read the original article Hit count: 221

tldr version: Renamed domain from internal.domain.com to domain.com, have 4 SPNs that am unable to remove from DC.

So my domain was internal.domain-name.com and I renamed it to domain-name.com and I thought everything was good. Several days later, I start setting up my RD Gateway and am noticing issues surrounding group policy. I run dcdiag and the SystemLog part fails.

      Starting test: SystemLog
     A warning event occurred.  EventID: 0x00001796
        Time Generated: 08/25/2014   02:48:30
        Event String:
        Microsoft Windows Server has detected that NTLM authentication is presently being used between clients and this server. This event occurs once per boot of the server on the first time a client uses NTLM with this server.
     An error event occurred.  EventID: 0xC0001B70
        Time Generated: 08/25/2014   02:49:18
        Event String:
        The SQL Server (MSSQLSERVER) service terminated with the following service-specific error: 
     An error event occurred.  EventID: 0xC0001B70
        Time Generated: 08/25/2014   02:49:48
        Event String:
        The SQL Server (MSSQLSERVER) service terminated with the following service-specific error: 
     An error event occurred.  EventID: 0xC0001B70
        Time Generated: 08/25/2014   02:52:47
        Event String:
        The SQL Server (MSSQLSERVER) service terminated with the following service-specific error: 

This made me check my AD for possible connections to the .internal domain. I found four which I remove by:

setspn -D E3514235-4B06-11D1-AB04-00C04FC2DCD2/d79fa59c-74ad-4610-a5e6-b71866c7a157/internal.domain-name.com ServerName
setspn -D HOST/ServerName.domain-name.com/internal.domain-name.com ServerName
setspn -D GC/ServerName.domain-name.com/internal.domain-name.com ServerName
setspn -D ldap/ServerName.domain-name.com/internal.domain-name.com ServerName

Also, checking my dns records, there's an internal subdomain that I can delete but it comes back as well. I've tried removing the spns to no avail. Is there something I'm missing?

© Server Fault or respective owner

Related posts about active-directory

Related posts about windows-server-2012-r2