setspn Command Builder and SPN Checker, Free in Your Browser

Enter an SPN, paste setspn output, or build a command. To see sample output, use the Acme samples.

Free, in your browser. There is no sign-up and no limit. The tool never connects to your domain, makes no network request and reads only the text you give it.

You run the commands it writes, with your own rights, in your own domain.

The tool has three parts:

1. Part 1 explains the components of one SPN.
2. Part 2 reads the output you paste from setspn. It flags the same SPN on two accounts, short names with no fully qualified partner, and malformed entries.
3. Part 3 builds the commands: -S, -A, -D, -L, -Q and -X.

Each switch gets a line on what it does, plus the PowerShell equivalent for a user account.

These come from the setspn reference (Microsoft Learn, read 2026-10-09). Run setspn from an elevated command prompt on a computer with the Active Directory Domain Services role tools.

Five examples follow the pattern the same page uses, with this tool’s Acme names. The second removes an SPN; the last finds every SPN for one name across a forest:

setspn -U -S HTTP/intranet.acme.example ACME\svc-intranet
setspn -D HTTP/intranet.acme.example ACME\svc-intranet
setspn -L ACME\svc-intranet
setspn -T * -T acme.example -X
setspn -T acme.example -F -Q */intranet

Microsoft also notes that SPNs must be built on the base name of the account you give; otherwise the directory returns a constraint violation error.

You may lack the right to change this property on some accounts.

The page says you can check the rights in Active Directory Users and Computers, and that the “Validated write to service principal name” permission can be delegated to a user or group.

PowerShell for a user account

The Active Directory module does the same job on a user object.

• Set-ADUser. Its -ServicePrincipalNames parameter takes a hashtable with Add, Remove or Replace.
• LDAP name. Its documentation gives the LDAP name of the property as servicePrincipalName.

Get-ADUser returns a default set of properties. For an attribute outside the default and extended sets, pass the LDAP display name to -Properties.

Get-ADUser -Identity svc-intranet -Properties servicePrincipalName | Select-Object -ExpandProperty servicePrincipalName
Set-ADUser -Identity svc-intranet -ServicePrincipalNames @{Add="HTTP/intranet.acme.example"}

Sources: the Set-ADUser and Get-ADUser pages, Microsoft Learn, read 2026-10-09.

Neither cmdlet is documented with a duplicate check, so run setspn -Q or -X first, or use setspn -S, which is built for it.

Four conditions must hold, and the SPN is only one of them. Microsoft’s Kerberos authentication troubleshooting guidance and its guide to troubleshooting Kerberos single sign-on issues (both read 2026-10-09) cover them.

1. The right service class on the right account. A web site uses HTTP. Register it on the account the web server’s service runs as: a domain service account if the application pool or service signs in with one, or the computer account if it runs as a built-in identity. A computer account with a HOST SPN already covers http unless it is placed explicitly elsewhere. Adding HTTP/ to a second account for the same name is how duplicates start.
2. The exact host name. The ticket is issued for the name the browser used. An alias, a CNAME or an IP address in the address bar asks for a different SPN, or none. Microsoft’s guide says to check the Edge AuthServerAllowlist policy, which should list the fully qualified names of the target servers. It also says Edge treats only the Internet and Local intranet zones.
3. A client that sends Kerberos. The site must offer Negotiate. Microsoft’s IIS baseline is Windows Authentication on and Anonymous Authentication off.
4. Sound infrastructure. This means clocks within five minutes of the domain controller, DNS that resolves the target name, and open ports to the domain controller. Microsoft says the client and the target service must not be on the same computer, or Kerberos is off by default.

A computer account is the machine’s identity; a service account is one you create for the service.

Either way, the SPN sits on the account the service signs in with. Microsoft says that when a service instance’s sign-in account changes, you must register the SPNs again under the new account.