NDES Authentication Failure (HTTP 401.2) - Assistance Required for SPN Cleanup

Question

NDES Authentication Failure (HTTP 401.2) - Assistance Required for SPN Cleanup

Lea Huber 5

Dear Microsoft Support Team,

We are experiencing an authentication issue with our Network Device Enrollment Service (NDES) following a recent migration to a dedicated service account. The system displays the following error during authentication attempts:

Error Code: HTTP 401.2 - Unauthorized

This error indicates that there is a Service Principal Name (SPN) conflict. The authentication fails because the NDES SPN remains registered to the original computer object rather than the new dedicated service account.

Environment & Issue Details:

Network Device Enrollment Service (NDES)

HTTP 401.2 - Unauthorized

Migrated NDES to a dedicated service account

Duplicate/Misconfigured SPN registered to the computer object

Could you please review this issue and advise on the appropriate resolution?

Please let us know if you require any additional information.

Thank you.

0 comments

1 answer

Your answer

Answer 1

Hello Lea,

The HTTP 401.2 error in your NDES environment is indeed consistent with a Kerberos authentication failure caused by an SPN mismatch. Since you migrated NDES to a dedicated service account, the SPN must be registered against that account rather than the original computer object. If the SPN remains tied to the machine account, Kerberos tickets will be issued incorrectly, resulting in the unauthorized error.

The resolution is to clean up the duplicate SPN and reassign it properly. First, identify the current SPN assignments by running setspn -Q http/<fqdn> and setspn -Q http/<hostname> from an elevated command prompt. You will likely see the HTTP SPN still bound to the computer object. Remove those entries with setspn -D http/<fqdn> <computername> and setspn -D http/<hostname> <computername>. Then, register them against the dedicated service account using setspn -S http/<fqdn> <serviceaccount> and setspn -S http/<hostname> <serviceaccount>.

After correcting the SPNs, ensure that the application pool in IIS hosting NDES is configured to run under the same dedicated service account. Also confirm that the account has the required delegation rights in Active Directory if you are using constrained delegation. A common oversight is forgetting to recycle the IIS application pool or restart IIS after the SPN reassignment, so make sure to do that to flush cached tickets.

If you continue to see 401.2 errors after the SPN cleanup, check the Kerberos event logs on the NDES server (Applications and Services Logs > Microsoft > Windows > Kerberos-Key-Distribution-Center) for ticketing errors. That will confirm whether the SPN reassignment has propagated correctly.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!HP.