- 1). Eliminate possible outside sources of errors by checking network configuration. Kerberos works with many other programs, so sometimes an apparent Kerberos problem is caused by something else, often the network not functioning. Make sure all computers on the network are able to communicate with each other and that the clocks are synchronized. If you need to reset the clock on a computer to match the rest of the domain, click "Start" and go to "Run." Type "net time /domain /set" and click "OK."
- 2). Check the setting for Integrated Windows Authentication if you are using Internet Explorer 6.0 or higher. This option must be enabled for Kerberos to work properly. Open Internet Explorer and select "Internet Options" from the "Tools" option in the menu across the top of the browser. Click the "Advanced" tab. Go to the security section and make sure "Enable Integrated Windows Authentication" is checked. If it is not, click the box next to it, select OK and restart the browser.
- 3). Check on your log-in name. Log-in names, also referred to as service principle names or SPN, must be registered, and will usually match the server name before Kerberos will allow you to log in with it. To add new SPNs, install the Setspn utility on the server. Then open the command prompt on the server and change directories to C:\Program Files\Resource Kit. Type the command "Setspn -A HTTP/newuser webserver1," where "newuser" is your log-in name and "webserver1" is the name of your server. This will allow you to use the new name to log-in through Kerberos authentication.
- 4). Verify the server is trusted for delegation. When the sever is part of a domain but is not the controller of that domain, it must be trusted for Kerberos to work. Go to the domain controller to set it. Click "Start," then "Settings," then "Control Panel." Double-click "Administrative Tools" and open "Active Directory Users and Computers." Locate your domain. Click the folder labeled "Computers." Locate the server in the list and right-click it to go to properties. In the properties box, click the "General" tab. If the box labeled "Trusted" for delegation is not checked, click it to check it off, then click "OK."
- Advertisement -
- Advertisement -