| Event Id | 11 |
| Source | KDC |
| Description | There are multiple accounts with name host/SERVERNAME.microsoft.com of type10 |
| Event Information | According to Microsoft: CAUSE 1: This behavior can be caused by a duplicate SPN (ServicePrincipalName) value in the Active Directory tree. RESOLUTION: NOTE: Only experienced administrators should consider using the Ldp.exe and Adsiedit.msc tools that are called for in the following procedure. To resolve this behavior, use the Ldp.exe tool to determine the location of the duplicate SPN value, and then use the Adsiedit.msc tool to remove the duplicate SPN value. Follow these steps on a Windows 2000-based domain controller: Click Start, and then click Run. Type ldp, and then click OK. Click Connection, click Connect, and then click OK. Leave the Server box blank. Click Connection, click Bind, and then click OK. Leave all fields blank. Click View, click Tree, and then click OK. Leave the BaseDN window blank. Click Browse, and then click Search. Set the BaseDN as DC=Home and DC=com, separated by a comma. For example, if the FQDN name of the domain is Mydomain.com, type DC=Mydomain,DC=com. Set the filter to the following: serviceprincipalname=Host/computername.home.com For example, if the relevant computer is named Computer1 and the domain name is Mydomain.com, type the following: serviceprincipalname=Host/Computer1.Mydomain.com Set Scope to Subtree, and then click Run. After you locate the duplicate SPN, you can use the Adsiedit.msc tool to go to the object, view the duplicate SPN value, and remove the duplicate SPN value. Move the server from the domain to a workgroup, delete the servers computer account from the domain, and then join the server to the domain again, using the same computer account. " CAUSE 2: There are two or more computer accounts that have the same service principal names (SPNs) registered. RESOLUTION : Locate the machine accounts that have the duplicate SPNs. To do so, use the following methods. Use the Ldifde u |
| Reference Links | Windows 2000 Server Prompts Domain User for Credentials Event ID 11 in the system log of domain controllers |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.