meta data for this page
  •  

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
windows:domain:start [2026/06/18 08:05] – titannetwindows:domain:start [2026/06/18 08:06] (current) – titannet
Line 9: Line 9:
   * Service principal name   * Service principal name
   * Unique identifier used in windows environments to link a specific network service to the Active Directory account running that service   * Unique identifier used in windows environments to link a specific network service to the Active Directory account running that service
 +  * [[https://syfuhs.net/a-bit-about-kerberos]]
  
  
-<code>+=== Reddit src === 
  
 An SPN is how your computer identifies a service on a network. That service could a be network protocol like HTTP or SMB. SPN and SPN binding are the same thing. Or rather, the binding is the literal registration of the SPN to the service account. See below. An SPN is how your computer identifies a service on a network. That service could a be network protocol like HTTP or SMB. SPN and SPN binding are the same thing. Or rather, the binding is the literal registration of the SPN to the service account. See below.
Line 32: Line 34:
  
 Now all of this is well and good, but there's a very specific case where this fails: when the SPN can't be found. AD returns an error to the client so the client needs to decide what to do with it. Usually it falls back to NTLM. This is why NTLM doesn't provide server authentication. That is, because AD cannot guarantee the thing you're connecting to matches any service it knows about. That is also why things often "just work" right up until you need to enable delegation, which only works with Kerberos. Now all of this is well and good, but there's a very specific case where this fails: when the SPN can't be found. AD returns an error to the client so the client needs to decide what to do with it. Usually it falls back to NTLM. This is why NTLM doesn't provide server authentication. That is, because AD cannot guarantee the thing you're connecting to matches any service it knows about. That is also why things often "just work" right up until you need to enable delegation, which only works with Kerberos.
-</code>