John, That is correct. msktutil updates the key of the computer account. So the second msktutil call with the same computer-name will make the first entry invalid. But you can have host and http asssigned to the same AD account if you use other tools like net ads join with net ads keytab.
Regards Markus "John Hefferman" <[email protected]> wrote in message news:[email protected]... > Dear list, > > To my knowledge (and after some tests), msktutil requires a separate > account in active directory for each service principal needed for a > machine. > > For instance, if a Linux computer is going to need a host/ and a http/ > service principal it would be nessesary to run msktutil twice, such as: > > msktutil -h fqdn --computer-name linux-computer --verbose -s host/fqdn -k > linuxComputer.keytab --server domainControllerFqdn > > msktutil -h fqdn --computer-name linux-computer-http --verbose -s > http/fqdn -k linuxComputerHttp.keytab --server domainControllerFqdn > > I just wanted to confirm this was the case, or whether it is possible to > have both host/ and http/ under the same account in AD. > > Thanks in advance for any help, > > John > > > > ________________________________________________ > Kerberos mailing list [email protected] > https://mailman.mit.edu/mailman/listinfo/kerberos > ________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos
