Jump to content


Server Principal Name

  • Please log in to reply
3 replies to this topic

#1 Dan



  • Members
  • Pip
  • 7 posts

Posted 04 April 2014 - 03:28 PM

My Netwrix Active Directory Change Reporter is telling me that there was a change twice in the last 3 days of: Service Principal Name: Added: MSSQLSvc/JMW.rl.int:49216

Since I'm the only SysAdmin with rights, and the station in question is locked down to least privilage, what does this mean?

How do I do any research on this? Googling Server Principal Name generates un usable results about server settings, nothing about AD Changes.

#2 jeffb


    Advanced Member

  • Administrators
  • PipPipPip
  • 384 posts
  • Gender:Male

Posted 04 April 2014 - 06:56 PM


"Service Principal name" http://technet.micro...y/cc961723.aspx can be changed either by user or by system itself (e.g. you restart some service, like SQL service).

To omit such changes if you choose open the omitproplist.txt file in AD Change Reporter installation directory and modify the following string:
#*.servicePrincipalName to *.servicePrincipalName
(just remove #)

Also in the unomitproplist.txt file change *.servicePrincipalName to #*.servicePrincipalName
(just add #)


#3 Dan



  • Members
  • Pip
  • 7 posts

Posted 04 April 2014 - 07:06 PM

So this could be a reboot? Would this event show up in the event log on that machine?

#4 Awisecup



  • Members
  • Pip
  • 1 posts
  • Gender:Male
  • Location:USA

Posted 09 March 2016 - 02:29 AM

Nightly, I receive the same email/notification as the OP for two of my SQL servers. I suspect the notifications are generated due to the nightly scheduled GFS backup, but there are 50 other virtual servers sever in my pool, 10 of which are also SQL servers, but Netwrix doesn't send notifications for any of the other VMs.
I don't know if this info helps the OP, but I suspect it's an issue with a service on both of the offending SQL VMs.

0 user(s) are reading this topic

0 members, guests, anonymous users