I think I have come across an odd situation for which this tool does not currently cover: disjoint namespace between the dnsRoot and nETBIOSName (aka Pre-Windows 2000 name) attributes for an Active Directory Domain. For example, there is a domain with a FQDN of "company.com" but the NetBIOS Name is "DOMAIN" (that is not a typo).
In this situation, there is a computer with a default instance of SQL Server 2017 installed and joined to the domain with an FQDN of computer.company.com and a NetBIOS (pre-windows 2000 name) of DOMAIN\computer. There are currently the following SPNs registered to the computer.company.com (aka DOMAIN\computer or company.com\computer) account. This can verified with the following commands:
SetSPN -L company.com\computer$
SetSPN -L DOMAIN\computer$
MSSQLSvc/computer:1433
MSSQLSvc/computer
MSSQLSvc/computer.company.com:1433
MSSQLSvc/computer.company.com
When running Kerberos Configuration Manager, it indicates that the SPNs are misplaced and proposes the following to resolve the issue:
SetSPN -d "MSSQLSvc/computer.company.com" "company\computer$"
SetSPN -s "MSSQLSvc/computer.company.com" "DOMAIN\computer$"
SetSPN -d "MSSQLSvc/computer.company.com:1433" "company\computer$"
SetSPN -s "MSSQLSvc/computer.company.com:1433" "DOMAIN\computer$"
The two SetSPN -d commands will fail as there is no such NetBIOS domain name of "company". The two SetSPN -s commands will also fail because there are already SPNs for DOMAIN\computer$.
Is this an unexpected bug for which Kerberos Configuration Manager was not designed to handle? Or is there something else afoot here? Thank you for your help and creating this great tool!