为什么不同主机上的SPN会导致服务器失去信任？ 我应该如何解决它？

我有一个全新的服务器映像，只要它join域，就会失去它的信任。 我怀疑这是因为使用此Powershell脚本的LDAP版本发现的重复的SPN

Powershell脚本

#Set Search cls $search = New-Object DirectoryServices.DirectorySearcher([ADSI]“”) $search.filter = “(servicePrincipalName=*)” $results = $search.Findall() #list results foreach($result in $results) { $userEntry = $result.GetDirectoryEntry() Write-host "Object Name = " $userEntry.name -backgroundcolor "yellow" -foregroundcolor "black" Write-host "DN = " $userEntry.distinguishedName Write-host "Object Cat. = " $userEntry.objectCategory Write-host "servicePrincipalNames" $i=1 foreach($SPN in $userEntry.servicePrincipalName) { Write-host "SPN(" $i ") = " $SPN $i+=1 } Write-host "" } 

主机与重复的SPN

 dn: CN=NYC01IMFE02,CN=Computers,DC=hp,DC=com changetype: add servicePrincipalName: MSSQLSvc/NYC01IMFE02.hp.com:52407 servicePrincipalName: MSSQLSvc/NYC01IMFE02.hp.com:LYNCLOCAL servicePrincipalName: MSSQLSvc/NYC01IMFE02.hp.com:59066 servicePrincipalName: MSSQLSvc/NYC01IMFE02.hp.com:RTCLOCAL servicePrincipalName: http/nyc01imfe02.hp.com servicePrincipalName: sip/nyc01imfe02.hp.com servicePrincipalName: TERMSRV/NYC01IMFE02.hp.com servicePrincipalName: TERMSRV/NYC01IMFE02 servicePrincipalName: WSMAN/NYC01IMFE02 servicePrincipalName: WSMAN/NYC01IMFE02.hp.com servicePrincipalName: RestrictedKrbHost/NYC01IMFE02 servicePrincipalName: HOST/NYC01IMFE02 servicePrincipalName: RestrictedKrbHost/NYC01IMFE02.hp.com servicePrincipalName: HOST/NYC01IMFE02.hp.com servicePrincipalName: TERMSRV/NYC01EXCAS04 servicePrincipalName: TERMSRV/NYC01EXCAS04.hp.com servicePrincipalName: RestrictedKrbHost/NYC01EXCAS04.hp.com servicePrincipalName: HOST/NYC01EXCAS04.hp.com servicePrincipalName: RestrictedKrbHost/NYC01EXCAS04 servicePrincipalName: HOST/NYC01EXCAS04 

我刚刚创build的主机

• Windows 8.1 Pro将“Microsoft live”帐户迁移到域帐户
• 如果查询解决策略包含客户端子网的网元操作员，则DNS策略不能正确parsing区域范围中的CNAME
• 痛苦地慢login到广告绑定Mac OS X Leopard机closures家庭networking
• Active Directory和Apple的工作组pipe理器
• 如何限制Windows ADlogin到某个组？

 dn: CN=nyc01excas04,CN=Computers,DC=hp,DC=com changetype: add servicePrincipalName: WSMAN/NYC01EXCAS04 servicePrincipalName: WSMAN/NYC01EXCAS04.hp.com servicePrincipalName: TERMSRV/NYC01EXCAS04 servicePrincipalName: TERMSRV/NYC01EXCAS04.hp.com servicePrincipalName: RestrictedKrbHost/NYC01EXCAS04 servicePrincipalName: HOST/NYC01EXCAS04 servicePrincipalName: RestrictedKrbHost/NYC01EXCAS04.hp.com servicePrincipalName: HOST/NYC01EXCAS04.hp.com 

题

1. 什么会导致这些条目位于错误的主机上？

。

 servicePrincipalName: TERMSRV/NYC01EXCAS04 servicePrincipalName: TERMSRV/NYC01EXCAS04.hp.com servicePrincipalName: RestrictedKrbHost/NYC01EXCAS04.hp.com servicePrincipalName: HOST/NYC01EXCAS04.hp.com servicePrincipalName: RestrictedKrbHost/NYC01EXCAS04 servicePrincipalName: HOST/NYC01EXCAS04 

2. 这些条目是什么意思？ 他们用了什么

3. 他们会在新机器上造成信任失败吗？ 为什么只有一台机器有问题，而不是另一台

4. 我如何纠正这个问题？