ASP Developer Network - Brought to you by Steve Radich and BitShop, Inc. - http://www.bitshop.com

ASPDeveloper

ASPDeveloper.Net / VirtualServerFAQ.COM

Make sure you go to our home page for:

* Virtual Server 2005 FAQ
* ASP.Net 2.0 Information
* ASP.Net 2.0 Streaming Tutorials
* ASP.Net 2.0 HTML based Tutorials

Made possible by Business Internet Technology Shop (BitShop)

Virtual Server 2005

Recent Virtual Server 2005 posts

* VS Administration Website Error
* client hangs on boot-to-da
* Help Please - Day long installation
* Wirelss Access!
* Best Backup Practice.. help me here Ben..
* How to completely remove Virtual Server 2005 R2
* How can you tell if...
* Is this possible ?
* Best hardware for Virtualization
* Host CPU usage
* VMAdditions for Linux
* "Recipe" for MS Loopback connector?
* xorg.conf Settings?
* The description for Event ID ( xxxx ) in Source ( Virtual Server ) cannot be found.
* VM Clustering across different host servers connected to a SAN
* Security and VS2005R2
* Logging in Multiple Times
* Running a LiveUpdate server
* The screen solution
* Windows 64bit

Add Solution

Virtual Server on domain controller and problem with SPN registrat

Source: microsoft.public.virtualserver
Sent: 04/15/2006
From: Maciej Boniecki
Message:

Hello Everybody!

I have Windows Server 2003 R2 Enterprise Edition running the following
services: DNS server, domain controller (AD), IIS and Virtual Server 2005 R2
Enterprise Edition. Due to not enough privileges of Network Service account
Virtual Server is not able to register service principal names in Active
Directory. This results in that when VS starts it puts warning message in the
event log "The service principal names for Virtual Server could not be
registered. Constrained delegation cannot be used until the SPNs have been
registered manually. Error 0x80072098 - Insufficient access rights to perform
the operation.". I have followed the suggestion and registered SPNs manually
using SETSPN command. Below I am putting positions which I have added:
vssrvc/T-DC-01
vssrvc/T-DC-01.domain1.taon
vmrc/T-DC-01:5900
vmrc/T-DC-01.domain1.taon:5900
but even after manual registration I still gets this warning. Does anyone
know how to fix it without changing account on which Virtual Server is
running? Thanks in advance for any help.

--
Maciej

Post Reply | This is Spam! | Mark as Spam

Related Messages

RE: Virtual Server on domain controller and problem with SPN registrat

Sent: 04/17/2006
From: Tony HInkle
Message:

You may need to modify the permissions on the computer account to allow your
VS account to write SPNs to it.

Start AD Computers & Users
Click Veiw, Advanced Features menu
Find the computer account for T-DC-01
Right-click, select Properties
Add the VS account if it is not there
Select the VS account and click Allow Full Control
- or, If you don't want to give Full Control access:
Click Advanced
Select the VS account and click Edit
Select Properties tab
Click Allow for Write servicePrincipalName

I have found recently that if you set the granular permission it sometimes
does not persist, so check it after you set it. If it doesn't persist, you
can use the Full Control perm to work around it.

"Maciej Boniecki" wrote:

Show quoted text

> Hello Everybody!
>
> I have Windows Server 2003 R2 Enterprise Edition running the following
> services: DNS server, domain controller (AD), IIS and Virtual Server 2005 R2
> Enterprise Edition. Due to not enough privileges of Network Service account
> Virtual Server is not able to register service principal names in Active
> Directory. This results in that when VS starts it puts warning message in the
> event log "The service principal names for Virtual Server could not be
> registered. Constrained delegation cannot be used until the SPNs have been
> registered manually. Error 0x80072098 - Insufficient access rights to perform
> the operation.". I have followed the suggestion and registered SPNs manually
> using SETSPN command. Below I am putting positions which I have added:
> vssrvc/T-DC-01
> vssrvc/T-DC-01.domain1.taon
> vmrc/T-DC-01:5900
> vmrc/T-DC-01.domain1.taon:5900
> but even after manual registration I still gets this warning. Does anyone
> know how to fix it without changing account on which Virtual Server is
> running? Thanks in advance for any help.
>
> --
> Maciej

RE: Virtual Server on domain controller and problem with SPN regis

Sent: 04/17/2006
From: Maciej Boniecki
Message:

Thanks Tony for this tip, after applying "Validated write to service
principal name" permission to Network Service account Virtual Server does not
log this warning event anymore. I used SETSPN command tool to see if there
any new SPNs registered and the answer is no, so I suppose that VS has some
problems with detection of existing SPNs.
--
Maciej

"Tony HInkle" wrote:

Show quoted text

>
> You may need to modify the permissions on the computer account to allow your
> VS account to write SPNs to it.
>
> Start AD Computers & Users
> Click Veiw, Advanced Features menu
> Find the computer account for T-DC-01
> Right-click, select Properties
> Add the VS account if it is not there
> Select the VS account and click Allow Full Control
> - or, If you don't want to give Full Control access:
> Click Advanced
> Select the VS account and click Edit
> Select Properties tab
> Click Allow for Write servicePrincipalName
>
> I have found recently that if you set the granular permission it sometimes
> does not persist, so check it after you set it. If it doesn't persist, you
> can use the Full Control perm to work around it.
>
>
> "Maciej Boniecki" wrote:
>
> > Hello Everybody!
> >
> > I have Windows Server 2003 R2 Enterprise Edition running the following
> > services: DNS server, domain controller (AD), IIS and Virtual Server 2005 R2
> > Enterprise Edition. Due to not enough privileges of Network Service account
> > Virtual Server is not able to register service principal names in Active
> > Directory. This results in that when VS starts it puts warning message in the
> > event log "The service principal names for Virtual Server could not be
> > registered. Constrained delegation cannot be used until the SPNs have been
> > registered manually. Error 0x80072098 - Insufficient access rights to perform
> > the operation.". I have followed the suggestion and registered SPNs manually
> > using SETSPN command. Below I am putting positions which I have added:
> > vssrvc/T-DC-01
> > vssrvc/T-DC-01.domain1.taon
> > vmrc/T-DC-01:5900
> > vmrc/T-DC-01.domain1.taon:5900
> > but even after manual registration I still gets this warning. Does anyone
> > know how to fix it without changing account on which Virtual Server is
> > running? Thanks in advance for any help.
> >
> > --
> > Maciej

Post Reply | This is Spam! | Mark as Spam

Other groups

Virtual PC (Mac)(3592)	Virtual PC(12844)	Virtual PC (French)(496)
Virtual Server 2005(6245)

Our Sponsors

Virtual Server 2005 Info Here!
http://www.aspdeveloper.net

Wiki

Blogs

Articles

Image galleries

File galleries

Forums

Maps

Directories

ASP Developer Network (since 1996) - Brought to you by Steve Radich and BitShop, Inc. - http://www.bitshop.com
Copyright © 1997-2005 by BitShop, Inc. All Rights Reserved.
No content may be reproduced in any form without written permission from BitShop, Inc.
We will be honored to assist with reproduction rights on our material if you contact us.
We also can provide print articles for your magazine, private training seminars at your site, and conference presentations.
Thank you for visiting. Please bookmark our site if you found it useful!
If you wish to make a donation it will help further the development of these free resources: