AD HelpDesk error resolution: "Unable to find the service principal requested."

Posted on 4/20/2012 by John Bowers in AD HelpDesk LDAP

The full text of the error is:

"Unable to find the service principal requested. The service principal may have been detected incorrectly in your network. Set the 'Default Domain Controller' in preferences to try and work around this."

The suggested resolution (setting the domain controller in preferences) really does work around the issue normally, but if you have done that and are still experiencing difficulties this post will help you solve the problem completely.

To understand how to fix the problem, you have to understand what is going wrong.  So I am going to start of with a bit of explanation.  When you get this error AD HelpDesk is requesting the ability to communicate with your DC over LDAP.  To do this is has to request a ticket to communicate with the LDAP service for your DC, and this is where things can occasionally go wrong.

AD HelpDesk has to "guess" what service it should request.  This isn't really a guess, as a domain controller almost always responds to a service name of "ldap/<dnshostname>".   But, as you can see there is a variable (the DNS Name) that MIGHT not match what is set on the "ServicePrincipalName" attribute of the domain controller you are trying to connect to.   A mismatch between the value set on the domain controller object's "servicePrincipalName" attribute and theFQDN we are resolving in AD HelpDesk is what usually generates this "Unable to find service principal" error.  

To work around this you can specify the correct service principal name in the  "Default Domain Controller" preference.  The "Default Domain Controller" preference just needs to match one of the service principal names on the desired domain controller (it doesn't even need to resolve via DNS if you also set the ip address in preferences as well).  There should be an "ldap/<dsnhostname>" set on each of your domain controllers, so normally setting the Default Domain Controller Preference to a DNS hostname should work fine, but occasionally there are multiple DNS names for a server and not all of them are set on the "servicePrincipalName" attribute.

You need to inspect the values of the "servicePrincipalName" on your domain controller and see what they are set to.  Launch MMC and load the ADSI Edit snap-in.  Browse to the domain controllers container and inspect the details on the domain controller object that corresponds to the domain controller you are trying to connect to:

 

Right click on the object and select properties.  Scroll down to "servicePrincipalName" and you should see something like this:



Notice that there are several service principal names that start with ldap/<NAME>.  Simply pick any one that starts with ldap and put the NAME portion in the application as the preferred domain controller.  Just to re-iterate, this doesn't actually have to be a resolvable DNS name so long as you have also set the preferred domain controller ip address.

If there are no ldap service principal names then firstly I would like to hear about it (I don't think this could possibly be the case) and second you can simply create one.  Adding an extra service principal name to your domain controller won't cause any harm.  (although this would be exceptionally unusual)

One other thing to note:  If there are two or more objects that have the same service principal name, then you will also get this error because the server doesn't know which one to give you.  So if you see that the value you are looking for IS set, then investigate the possibility of a duplicate service principal name.  

Comments