Topic Last Modified: 2007-10-04

The Microsoft Exchange Server Analyzer Tool queries the Active Directory directory service to find the values returned for the servicePrincipalName attribute of the Exchange server computer accounts for the Exchange resources listed in the table below.

Exchange Resource servicePrincipalName value Expected Value Returned

exchangeMDB

Fully Qualified Domain Name (FQDN)

exchangeMDB

NetBIOS name

exchangeRFR

Fully Qualified Domain Name (FQDN)

exchangeRFR

NetBIOS name

SMTP

Fully Qualified Domain Name (FQDN)

SMTP

NetBIOS name

SMTPSVC

Fully Qualified Domain Name (FQDN)

SMTPSVC

NetBIOS name

HOST

Fully Qualified Domain Name (FQDN)

HOST

NetBIOS name

If the Exchange Server Analyzer finds that the servicePrincipalName attribute for the computer account of an Exchange resource is missing one of the expected values listed here, the Exchange Server Analyzer displays an error.

A Service Principal Name (SPN) is a unique name that identifies an instance of a service and is associated with the logon account under which the service instance runs. Kerberos authentication is not possible for Exchange services without properly set SPNs.

To resolve this issue, follow these steps to add the missing values for the affected attributes.

Note:
If you are experiencing this issue in an Exchange 2007 Cluster environment, follow the guidance in Microsoft Knowledge Base article 935676, "Event ID 9317 is logged when the Microsoft Exchange System Attendant service comes online on an Exchange 2007 cluster node" (http://go.microsoft.com/fwlink/?linkid=3052&kbid=935676).
Use the SETSPN.exe tool to add an SPN with the missing values
  1. Install the Setspn.exe tool. To obtain the Setspn.exe tool, see "Windows 2000 Resource Kit Tool : Setspn.exe" (http://go.microsoft.com/fwlink/?LinkId=28103).

    The Windows Server 2003 version of the Setspn.exe command-line tool is available in the Windows Server 2003 Support Tools that are included on the Windows Server 2003 CD. To install the Server 2003 Support Tools, double-click the Suptools.msi file in the Support/Tools folder.

  2. Follow the guidance in the SETSPN.EXE Setspn_d.txt file to add the missing value to the Active Directory object for your Exchange server. The following example demonstrates adding the FQDN value for a virtual SMTP server SPN:

    • Start a command prompt, and then change to the directory where you installed Setspn.exe.

    • At the command prompt, type the following command, then press Enter.

      setspn.exe -a SMTPSVC/ mail.yourdomain.com YOURSERVERNAME

      Note:
      Replace mail.yourdomain.com with your SMTP virtual server FQDN and YOURSERVERNAME with the name of the Exchange server. There is no space between SMTPSVC/ and mail.yourdomain.com in the command above.