AD FS 2.0: How to Configure the SPN (servicePrincipalName) for the Service Account

AD FS 2.0: How to Configure the SPN (servicePrincipalName) for the Service Account


When you deploy an AD FS 2.0 Federation Server farm you must specify a domain-based service account, and the AD FS 2.0 service account needs to have a SPN (servicePrincipalName) registered to allow Kerberos to function for the Federation Service.

When you initially configure the AD FS 2.0 farm, the configuration wizard will attempt to set the SPN for you as long as the account running the configuration wizard has Write access to the servicePrincipalName attribute on the service account in Active Directory.


Reasons you may need to manually set the SPN on the AD FS 2.0 service account:

  • SPN registration failed during initial configuration of the farm
  • The Federation Service name has changed
  • The service account has changed


The SPN to register is in the following format:



You can register the SPN using setspn.exe, ADSIEDIT, or any utility capable of writing Active Directory LDAP attributes.


Syntax for SetSPN.exe:

setspn -a host/{your_Federation_Service_name} {domain_name}\{service_account}


In Windows Server 2008 and later, the SetSPN.exe utility provides a way to ensure that you are not duplicating SPN's in the forest:

setspn -x


setspn -s host/{your_Federation_Service_name} {domain_name}\{service_account}


More Information

As an Active Directory admin, you may ask: "Why do we need the HOST SPN instead of the HTTP SPN?"


AD FS 2.0 utilizes the HOST service type for SPN registration because of default Windows Communication Foundation (WCF) SPN requirements. While HTTP makes sense for web-based applications, it does not satisfy rich clients who use the WS-Trust protocol.

What's my Federation Service Name?


From the ADFS Management console, select Edit Federation Service Properties. The Federation Service name is listed in the middle textbox.

Sort by: Published Date | Most Recent | Most Useful
  • do you have to restart AD FS service after setting this SPN? what should i do after i set this Spn

  • How ADFS must be configured if HOST SPN is already registered with the computer account?

    I am setting up ADFS farm and I am using user created service account in AD, but I cannot register HOST SPN on it, because it is already registered with the computer account. What I am supposed to do?

  • Ditto...I've rebuilt mine (with different server names) and each time I get that warning at the end of install.

    Also, what might be an appropriate question is what is the "your_Federation_Service_name"? Is that the server name, or something else?

  • You could run the following PowerShell to locate the object that is currently holding the HOST SPN you are trying to use.

    Note: Make sure you replace the******** below with the HOST SPN you are trying to find.



    Import-Module ActiveDirectory

    get-aduser -filter * -Properties cn,servicePrincipleName | Where {$_.servicePrincipleName -eq "host/********"}

  • Hey JohnKozell, just in case evolutionmonkey's reply did not help:

    "your_Federation_Service_name" is simply the name of your federation. So if you are setting up a federation for and you're following the standard of naming your Federation sts (could be adfs, fs, or whatever) then your full federation name would be If your service account is called svcADFSFarm, for example, then you would enter the following (for Server 2008 and later):

    setspn -s host/\svcADFSFarm

    Remember to run your Command Prompt with elevated privileges or you will get an "Access Denied" message.

    The best thing to do is to always build a Federation Farm, even if you are building a single Federation server, so you can add more servers later. You cannot convert a Stand-alone instance to a Farm.

    Looks like you'll have to remove the SPN from the Computer account, then add it to the service account. Do this in your Test environment first just to make sure. The SPN syntax is here:

    Restarting the AD FS service should not be required.