Quote

How to troubleshoot the "Cannot generate SSPI context" error message

In order to delegate the authority to a service account to allow it to register and unregister its own SPN's, perform the following steps

1.	Click Start, click Run, type Adsiedit.msc, and then click OK.
2.	In the ADSI Edit snap-in, expand Domain [DomainName], expand DC= RootDomainName, expand CN=Users, right-click CN= AccountName, and then click Properties. Notes • DomainName is a placeholder for the name of the domain. • RootDomainName is a placeholder for the name of the root domain. • AccountName is a placeholder for the account that you specify to start the SQL Server service. • If you specify the Local System account to start the SQL Server service, AccountName is a placeholder for the account that you use to log on to Microsoft Windows. • If you specify a domain user account to start the SQL Server service, AccountName is a placeholder for the domain user account.
3.	In the CN= AccountName Properties dialog box, click the Security tab.
4.	On the Security tab, click Advanced.
5.	In the Advanced Security Settings dialog box, make sure that SELF is listed under Permission entries. If SELF is not listed, click Add, and then add SELF.
6.	Under Permission entries, click SELF, and then click Edit.
7.	In the Permission Entry dialog box, click the Properties tab.
8.	On the Properties tab, click This object only in the Apply onto list, and then make sure that the check boxes for the following permissions are selected under Permissions: • Read servicePrincipalName • Write servicePrincipalName
9.	Click OK three times, and then exit the ADSI Edit snap-in.