https://pwsh.in/tags/spn/Recent content in SPN on Vibhu Bhatnagar — PowerShell & Infrastructure EngineerHugo -- gohugo.ioenMon, 20 Jul 2026 07:30:24 +0530https://pwsh.in/posts/migrate-spn-new-account/Mon, 20 Jul 2026 07:30:24 +0530https://pwsh.in/posts/migrate-spn-new-account/<h2 id="what-this-covers">What This Covers</h2> <p>How to move a Kerberos Service Principal Name (SPN) from one account to another — the manual step migrations, server renames, and account swaps don&rsquo;t do for you.</p> <h2 id="before-you-start">Before You Start</h2> <ul> <li>Domain Admin or delegated <code>Validated write to servicePrincipalName</code> rights on both the old and new accounts</li> <li><code>setspn.exe</code> (built into Windows Server, RSAT-AD-Tools on clients)</li> <li>The exact SPN string you&rsquo;re moving — run <code>setspn -Q &lt;SPN&gt;</code> if you&rsquo;re not sure who currently holds it</li> <li>A maintenance window: clients holding cached Kerberos tickets against the old SPN mapping will keep failing until tickets expire or are purged</li> </ul> <h2 id="steps">Steps</h2> <h3 id="step-1-inventory-all-spns-on-an-account">Step 1: Inventory all SPNs on an account</h3> <p>Before touching anything, see the full picture — every SPN a given service or machine account currently holds:</p>