Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

Kerberos Configuration Manager for SQL Server is available


View products that this article applies to.

This article describes the Microsoft Kerberos Configuration Manager diagnostic tool for SQL Server. This tool is available for download from the Microsoft Download Center: 

Download Download the package now.

↑ Back to the top


About Kerberos Configuration Manager

The Kerberos Configuration Manager for SQL Server is a diagnostic tool that helps troubleshoot Kerberos related connectivity issues with SQL Server, SQL Server Reporting Services (SSRS), and SQL Server Analysis Services (SSAS). It can perform the following functions:

  • Collect information about operating system (OS), Microsoft SQL Server instances, and Always On Availability Group Listeners installed on a server.
  • Report all Service Principal Name (SPN) and delegation configurations on the server.
  • Identify potential problems in SPNs and delegations.
  • Fix potential SPN problems.

↑ Back to the top


More Information


This tool helps troubleshoot the following exceptions:
  • 401
    Note This error message is for http errors, SSRS errors, and some other similar errors.
  • Login failed for user 'NTAUTHORITY\ANONYMOUS'
  • Login failed for user '(null)'
  • Login failed for user ''
  • Cannot generate SSPI Context

For more information about Kerberos Configuration Manager, go to the following related blog:

SQL Server Release Services: Kerberos Config Tool

To Start the Tool:

  1. After the installation is complete successfully, double-click KerberosConfigMgr.exe to start the application.
  2. To troubleshoot the connectivity issue with SQL Server, connect to the destination computer by using a domain user account that has user permissions to that computer.
  3. To troubleshoot the connectivity issue with SSRS, connect to the destination computer by using a domain user account that has administrative permissions to that computer.


To Generate the SPN List from the Command Line:

  1. Go to the command line. (Note: To troubleshoot the connectivity issue with SSRS, start the command line window as administrator.)
  2. Switch to the folder where KerberosConfigMgr.exe is.
  3. Type KerberosConfigMgr.exe -q -l
  4. For more command-line option, type KerberosConfigMgr.exe -h


To Save a Server's Kerberos Configuration Information:

  1. Connect to the target windows server.
  2. Click the Save button on the toolbar.
  3. Specify the location where you want the file to be saved. It can be on a local drive or a network share.
  4. The file will be saved as the .XML format.


To View a Server's Kerberos Configuration Information from the Saved File:

  1. Click the Load button on the toolbar.
  2. Open the XML file generated by Kerberos Configuration Manager.


To Generate a Script to Fix the SPN from the Command Line:

  1. Click the Generate button for the SPN entry.
  2. The generated script can be used by a user who has permissions to fix the SPN on the server.


To See the Log Files for This Tool:

By default, one log file is generated every time that the application is run in the user's application data folder: %APPDATA%\Microsoft\KerberosConfigMgr.


To Get Help:

Option 1: Hover the pointer over the command for tooltip.

Option 2: Run KerberosConfigMgr.exe –h from the command line.

Option 3: Click the Help button in the toolbar.

↑ Back to the top


Keywords: kb, kbsurveynew, kbexpertiseadvanced, atdownload

↑ Back to the top

Article Info
Article ID : 2985455
Revision : 7
Created on : 11/21/2017
Published on : 11/21/2017
Exists online : False
Views : 415