In Windows Server 2008 R2 system log there are following kind of periodical errors:
For MSSQLSvc/<server_fqdn>:dlo
Event 3:
- Error Code: 0x7 KDC_ERR_S_PRINCIPAL_UNKNOWN
- Extended Error: 0xc0000035 KLIN(0)
- Server Name: MSSQLSvc/<server_fqdn>:dlo
- Target Name: MSSQLSvc/<server_fqdn>:dlo@<domain>
Event 11:
- The KDC encountered duplicate names while processing a Kerberos authentication request. The duplicate name is MSSQLSvc/<server_fqdn>:dlo (of type DS_SERVICE_PRINCIPAL_NAME). This may result in authentication failures or downgrades to NTLM. In order to prevent this from occuring remove the duplicate entries for MSSQLSvc/<server_fqdn>::dlo in Active Directory.
For MSSQLSvc/<server_fqdn>:DEDUPE:
- Similar kind of events 3 and 11 as above but with name "dedupe"
History:
I remember these have started after I installed DLO 7.5 on server where I had BE2010R3 but I am not sure if messages are related to this action at all. Prior to doing that I removed the DLO version which was delivered with BE2010. Installation of DLO7.5 was succesfull. Now I have upgraded from BE2010R3 to BE2014, and messages are still there.
I was able to locate words "DEDUPE" and "DLO" using program "ldp.exe" and search rule "(objectClass=*)" for whole domain (http://blog.sysoptools.com/2010/03/find-and-list-duplicate-upn.html).
First pair is under:
- "Dn: CN=Administrator,CN=Users,DC=<domain_name>,DC=local"
- . . .
- servicePrincipalName (6):
MSSQLSvc/<server_fqdn>:52535;
MSSQLSvc/<server_fqdn>:BKUPEXEC;
MSSQLSvc/<server_fqdn>:59387;
MSSQLSvc/<server_fqdn>:DEDUPE;
MSSQLSvc/<server_fqdn>:58585;
MSSQLSvc/<server_fqdn>:DLO;
Second one is under:
- "Dn: CN=<server>,OU=Domain Controllers,DC=<domain_name>,DC=local"
- . . .
- servicePrincipalName (28):
MSSQLSvc/<server_fqdn>:58585;
MSSQLSvc/<server_fqdn>:DLO;
MSSQLSvc/<server_fqdn>:59387;
MSSQLSvc/<server_fqdn>:DEDUPE;
MSSQLSvc/<server_fqdn>:52535;
{14E52635-0A95-4a5c-BDB1-E0D0C703B6C8}/<server>;
{14E52635-0A95-4a5c-BDB1-E0D0C703B6C8}/<server_fqdn>;
ldap/<server_fqdn>/ForestDnsZones.<domain_name>.local;
ldap/<server_fqdn>/DomainDnsZones.<domain_name>.local;
TERMSRV/<server>; TERMSRV/<server_fqdn>;
Dfsr-12F9A27C-BF97-4787-9364-D31B6C55EB04/<server_fqdn>;
DNS/<server_fqdn>; GC/<server_fqdn>/<domain_name>.local;
RestrictedKrbHost/<server_fqdn>;
RestrictedKrbHost/<server>;
HOST/<server>/<domain_name>;
HOST/<server_fqdn>/<domain_name>;
HOST/<server>; HOST/<server_fqdn>;
HOST/<server_fqdn>/<domain_name>.local;
E3514235-4B06-11D1-AB04-00C04FC2DCD2/056f2fae-9957-4a88-8556-40664dd7244c/<domain_name>.local;
ldap/<server>/<domain_name>;
ldap/056f2fae-9957-4a88-8556-40664dd7244c._msdcs.<domain_name>.local;
ldap/<server_fqdn>/<domain_name>; ldap/<server>;
ldap/<server_fqdn>;
ldap/<server_fqdn>/<domain_name>.local;
In "Active Directory Users and Computers" I can find attribute "servicePrincipalName" in user "Administrator" and server "<server>" properties under tab "Attribute editor" (set "Filter" so that everything is displayed).
Are these two places for names DEDUPE and DLO somehow conflicting and causing the error messages.. or what is this about... what is the reason for messages 3 and 11?
Something should be removed , but what is it and how? .... What should I do to get rid of these errors?
Help is highly appreciated.