Impact of removing SPN "HOST/<Computer-name>.<domain>" from computer object "<Computer-name>"

ShamsElDin, Tamer 5 Reputation points
2025-05-09T00:00:06.4+00:00

Hello,

During a migration from one Windows server "windows-server.lab" to a NAS storage, what will be the impact of removing the SPN "HOST/windows-server.lab" from the computer object "CN=Windows-Server,CN=Computers,DC=lab" and creating the SPN under the NAS storage's computer object?

Assuming that post switchover, the FQDN of "windows-server.lab" will change its DNS record to point to the NAS storage, + I will create a new FQDN for the Windows server so it can be used for access for some time.

I know that moving the SPN from one computer object to another is critical for Kerberos authentication, otherwise, tickets will be encrypted using the computer object's password, different from the password of the desired computer object.

I am wondering if the SPN "which is based on HOST/<Computer-name>.<domain>" is special and can't be removed from the original computer object "<Computer-name>".

Thank you

Windows for business | Windows Server | User experience | Other
{count} vote

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.