DRAG DROP
You are a network administrator of an Active Directory domain named contoso.com.
You have a server named Server1 that runs Windows Server 2012 R2. Server1 has the Web Server (IIS)
server role installed.
Server1 will host a web site at URL https: //secure.contoso.com. The application pool identity account of the
web site will be set to a domain user account named AppPool1.
You need to identify the setspn.exe command that you must run to configure the appropriate Service Principal
Name (SPN) for the web site.
What should you run?
To answer, drag the appropriate objects to the correct location. Each object may be used once, more than
once, or not at all. You may need to drag the split bar between panes or scroll to view content.
Select and Place:

Answer:

Explanation:
Note:
* -s <SPN>
Adds the specified SPN for the computer, after verifying that no duplicates exist.
Usage: setspn –s SPN accountname
For example, to register SPN “http/daserver” for computer “daserver1”:
setspn -S http/daserver daserver1
http://technet.microsoft.com/en-us/library/cc731241(v=ws.10).aspx
Attn: with Windows 2008 option is -a but with Windows 2012 it started to show -sDefinition of an SPN
An SPN is the name by which a client uniquely identifies an instance of a service. If you install multiple
instances of a service on computers throughout a forest, each service instance must have its own SPN. A
particular service instance can have multiple SPNs if there are multiple names that clients might use for
authentication. For example, an SPN always includes the name of the host computer on which the service
instance is running. Therefore, a service instance might register an SPN for each name or alias of its host.
Adding SPNs
To add an SPN, use the setspn -s service/namehostname command at a command prompt, where service/
name is the SPN that you want to add and hostname is the actual host name of the computer object that you
want to update. For example, if there is an Active Directory domain controller with the host name
server1.contoso.com that requires an SPN for the Lightweight Directory Access Protocol (LDAP), type setspn -s
ldap/server1.contoso.com server1, and then press ENTER to add the SPN.
The HTTP service class
The HTTP service class differs from the HTTP protocol. Both the HTTP protocol and the HTTPS protocol use
the HTTP service class. The service class is the string that identifies the general class of service.
For example, the command may resemble the following command:
setspn –S HTTP/iis6server1. mydomain.com mydomain\\appPool1

http://support.microsoft.com/kb/929650/en-us
http://technet.microsoft.com/en-us/library/cc731241%28v=ws.10%29.aspx