Configure Kerberos delegation for out-of-process configuration

This procedure must be performed by a network administrator who has rights on the Active Directory Server. This topic only covers unconstrained delegation. If you require a different configuration, please consult your network administrator.

1. Set the following service principal names (SPNs) for the account that is running SQL Server, ensuring that you are not creating duplicates.

   • MSSQLSvc/<SQL Server FQDN>:<Port>

   • MSSQLSvc/<SQL Server Hostname>:<Port>

   Note: If SQL Server is running under a System Account, such as Network Service, this step should not be necessary.

2. To verify that the SPNs are set, run the following command:

   setspn.exe -L <SQL Server Account>

   SQL Server Account is MachineName$ if SQL Server is running under a service account or Domain/User if it is running under a domain user.

   The result should be similar to the following:

   

3. In Active Directory, configure the domain account so that it is trusted for delegation.