How to fix SPN issue on Windows Server 2012R2 domain controller?

Question

Active Directory

Hello.
Recently, on one of the domain controllers, the following error began to appear:

The Kerberos client received a KRB_AP_ERR_MODIFIED error from the kem-dc-01$ server. The target name used was MLVZ\KEM-DC-01$. This means that the target server was unable to decrypt the ticket provided by the client. This is possible when the target SPN is registered to an account other than the account used by the target service. Make sure the target SPN is only registered to the account used by the server. This error can also occur if the target service's password differs from the password set for it in the Kerberos Key Distribution Center. Make sure that the passwords in the service on the server and in the KDC match. If the server name is incomplete and the destination domain (MLVZ.LOCAL) is different from the client domain (MLVZ.LOCAL),

PS C:\Users\Administrator.MLVZ> setspn -q MLVZ/TUMEN-DC
Domain check DC=MLVZ,DC=LOCAL
No such SPN found.

Accordingly, the replica between the CD does not pass.
It seems that the accounts with which I set up the CD successfully access it via RDP.
Tried https://social.technet.microsoft.com/Forums/window... didn't help.
I don't really want to lower the controller and raise it again.

Answer 1

in this case, resetting the administrator password helped me, I didn’t have replication between the two controllers, on dc1 I did netdom resetpwd /server:dc2 /userd:user /passwordd:password and also on myself netdom resetpwd /server:dc1 /userd:user /passwordd:password, did the same thing on dc2 and it worked...of course, the user and password must be the same for each request, and they turned out to be 4 identical...albeit not relevant, but I hope that it is for someone help =)