Repairing SPN records after domain controller rename

Omo Bento 20 Reputation points
2026-08-17T10:57:37.7933333+00:00

When a Domain Controller is renamed, sometimes its Service Principal Names (SPNs) in Active Directory aren’t automatically updated. This mismatch can cause domain clients to reject Kerberos tickets issued by the renamed DC, leading to authentication failures across the environment.

To fix this, you can use the setspn command to manually repair or re-register the SPN records for the affected Domain Controller. The process involves verifying existing SPNs, removing outdated entries, and adding the correct ones that match the new hostname.

Is there a recommended PowerShell or command-line sequence to safely perform this SPN repair without disrupting replication or authentication services ?

Windows for business | Windows 365 Business
0 comments
Answer accepted by question author
Marcin Policht 107.2K Reputation points MVP Volunteer Moderator
2026-08-17T11:03:32.7333333+00:00

Correct - verify first, change only what is actually wrong, and let Netlogon re-register its SPNs. On the renamed DC, check the current SPNs:

setspn -L NEWDC

Then search for stale SPNs containing the old name:

setspn -Q */OLDDC
setspn -Q */OLDDC.contoso.com

Also check for duplicate SPNs:

setspn -X

If you find an obsolete SPN registered against the renamed DC, remove only that specific entry:

setspn -D HOST/OLDDC NEWDC

If a required SPN is genuinely missing, use -S, which checks for duplicates before adding it:

setspn -S HOST/NEWDC NEWDC
setspn -S HOST/NEWDC.contoso.com NEWDC

Afterward, restart Netlogon to trigger registration again:

net stop netlogon
net start netlogon

Finally, verify replication with:

repadmin /replsummary

Do not delete and recreate the entire SPN set manually. Domain Controllers have numerous automatically managed SPNs, and unnecessary changes can create additional Kerberos problems.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Oldest
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.