Users experience authentication issues when they access a Web page in IIS 6.0 or query Microsoft SQL Server 2000 after you install Windows Server 2003 Service Pack 1

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 How to back up and restore the registry in Windows

Important By default, loopback check functionality is turned on in Windows Server 2003 SP1, and the DisableLoopbackCheck registry entry is set to 0 (zero). The security is reduced when you disable the authentication loopback check, and you open the Windows Server 2003 server for man-in-the-middle (MITM) attacks on NTLM. To avoid MITM attacks, the value of registry entry should be returned to zero (0) after the SPN changes are made. Also, method 1 is the preferred solution.

Method 1: Create the Local Security Authority host names that can be referenced in an NTLM authentication request (preferred)

1. Click Start, click Run, type regedit, and then click OK.
   
2. In Registry Editor, locate and then click the following registry key:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
3. Right-click MSV1_0, point to
   New, and then click Multi-String Value.
   
4. Type BackConnectionHostNames, and then press ENTER.
5. Right-click BackConnectionHostNames, and then click Modify.
6. In the Value data box, type the host name or the host names for the sites that are on the local computer, and then click
   OK.
7. Exit Registry Editor, and then restart the server for this change to take effect.

Method 2: Disable the authentication loopback check and register the SPN with the account that the service runs under

To resolve this issue, disable the authentication loopback check, and then register the SPN with the account that the service runs under. To do this, set the DisableLoopbackCheck entry in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa registry subkey to 1, and then determine the name of the SPN.

Step 1: To set the DisableLoopbackCheck registry entry to 1

1. Click Start, click Run, type regedit, and then click
   OK.
2. Locate and then click the following registry subkey:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
3. Right-click DisableLoopbackCheck, and then click Modify.
4. Type 1 in the Value data box, and then click OK.

Step 2: To determine the name of the SPN

1. Add the following registry entries, and then set each registry entry to the appropriate value as follows:
   
   • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\LogLevel
     Value: 1
   • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\LogToFile
     Value: 1
   • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\KerbDebugLevel
     Value: c3
   • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters\LogLevel
     Value:1 1
   • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters\LogToFile
     Value:1
     
   • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters\KerbDebugLevel
     Value: c3
   To add a registry entry, follow these steps:
   
   1. Locate and then click the registry subkey where you want to add the registry entry.
   2. On the Edit menu, point to
      New, and then click DWORD Value.
   3. Type the name of the registry entry that you want to add, and then press ENTER.
   4. Right-click the registry entry that you added in step 2c, and then click Modify.
   5. Type the appropriate value for that registry entry, and then click OK.
   6. Repeat step 2a through 2e for each registry entry that you want to add.
   7. Quit Registry Editor.
2. Restart the computer, and then reproduce the issue. After you do this, an event ID error message that is similar to the following is logged in the System log:
   Type: Error
   Source: Kerberos
   Category: None
   Event ID: 3
   Description: A Kerberos Error Message was received:
   on logon session
   Client Time:
   Server Time:
   TimeDate
   Error Code: 0x7 KDC_ERR_S_PRINCIPAL_UNKNOWN
   Extended Error:
   Client Realm:
   
   Client Name:
   Server Realm: DomainName.com
   
   Server Name: MSSQLSvc/DomainName.com:1433
   
   Target Name: MSSQLSvc/ServerName.DomainName:1433@DomainName.com
   Error Text:
   File: 9
   Line: ab8
   Error Data is in record data.
   
   Determine the SPN from the event ID error message. In this example, the SPN is MSSQLSvc/DomainName.com:1433.

Step 3: Use the Setspn.exe command-line tool to register the SPN to the appropriate service account

In IIS 6.0, the service account is typically the account that the WWW service runs under or the account that the application pool uses. In Microsoft SQL Server 2000, the service account is the account that SQL Server 2000 runs under. Use the following syntax to add a new SPN:
The following is an example of how to use the Setspn.exe command-line tool to add an SPN: