3.1.1.5.3.1.1.4 servicePrincipalName

The object has class computer (or a subclass of computer).

In AD DS, the servicePrincipalName value satisfies the following constraints:

  • The SPN is a syntactically correct two-part SPN, or it is a syntactically correct three-part SPN and the object is a DC's domain controller object (see sections 6.1.1.3.1 and 6.1.1.3.2). See section 2.2.21 for the syntax of an SPN.

  • The SPN MUST NOT contain an ":instancename" component.

  • One of the following constraints:

  • The SPN is a three-part SPN and the service name matches one of the following constraints:

    • The service class is "GC" and the service name matches one of the following: the dnsRoot, or the msDS-DnsRootAlias of the crossRef object representing the forest root domain NC.

    • The service class is "ldap" and the service name matches one of the following: the NetBIOSName, the dnsRoot, or the msDS-DnsRootAlias of a crossRef object representing the domain NC or one of the application NCs hosted by the DC.

The requester must have the Validated-SPN validated write right.