Legacy Update: Get back online, activate, and install updates on your legacy Windows PC

Microsoft Kerberos Configuration Manager for SQL Server is a diagnostic tool that helps troubleshoot Kerberos related connectivity issues with SQL Server, SQL Server Reporting Services, and SQL Server Analysis Services.

• Kerberos authentication provides a highly secure method to authenticate client and server entities (security principals) on a network. To use Kerberos authentication with SQL Server, a Service Principal Name (SPN) must be registered with Active Directory, which plays the role of the Key Distribution Center in a Windows domain. In addition, many customers also enable delegation for multi-tier applications using SQL Server. In such a setup, it may be difficult to troubleshoot the connectivity problems with SQL Server when Kerberos authentication fails.
  
  The Kerberos Configuration Manager for SQL Server is a diagnostic tool that helps troubleshoot Kerberos related connectivity issues with SQL Server, SQL Server Reporting Services, and SQL Server Analysis Services. It can perform the following functions:
  
  • Gather information on OS, Microsoft SQL Server instances and Always On Availability Group Listeners installed on a server.
  • Report on all SPN and delegation configurations on the server.
  • Identify potential problems in SPNs and delegations.
  • Fix potential SPN problems.

Files

Status: Live This download is still available on microsoft.com. The downloads below will come directly from the Microsoft Download Center.

File	Size
KerberosX64MSI.msi SHA1: 6082100b1e95484fd3412a9a4bb01e0db9fc7818	506 KB
KerberosX86MSI.msi SHA1: 2a807cd576b8bda45fbd1e5be49962a80ff7dc11	506 KB

File sizes and hashes are retrieved from the Wayback Machine’s indexes. They may not match the latest versions of files hosted on Microsoft servers.

• Supported SQL Server versions
  
  SQL Server 2008 through SQL Server 2019
  
  Support notes:
  • SQL Server 2008 and SQL Server 2008 R2 are no longer supported. For more information, refer to SQL Server end of support options.
    
  • SQL Server Reporting Services in SharePoint mode is not supported.
    
  • For Always On Availability Group Listeners discovery, run this tool from the owner node.
    
  • Microsoft Kerberos Configuration Manager for SQL Server requires a user with permission to connect to the WMI service on any machine its connecting to. For more information, refer to Securing a Remote WMI Connection.
    
  • The following are required on the machine where the Kerberos Configuration Manager for SQL Server is launched:
  • .NET framework 4.0 or higher.

• To install:
  
  1. Download the 32-bit or 64-bit version of the Kerberos Configuration Manager (KCM) installer that matches your computer’s OS architecture.
  2. Click Open to start the installation immediately or click Save to save the installation .msi file to disk and install it later.
  3. Accept the license term of this tool.
  4. Click Next to complete the installation.
  5. By default, this application is installed under %SystemDrive%:\Program Files\Microsoft\Kerberos Configuration Manager for SQL Server.
  
  
  
  To launch the KCM tool:
  
  1. After the installation is complete successfully, double click KerberosConfigMgr.exe to launch the application.
  2. To troubleshoot a connectivity issue with SQL Server, connect to the target computer with a domain user account that has user permission to that computer.
  3. To troubleshoot a connectivity issue with SQL Reporting Services, connect to the target computer with a domain user account that has administrator level permissions to that computer.
  
  To generate the SPN list from the command line:
  
  1. Open a command line window.
  • IMPORTANT: To troubleshoot connectivity issue with SQL Reporting Services, launch the command line window as an administrator.
  2. Switch to the folder where KerberosConfigMgr.exe is located.
  3. Type KerberosConfigMgr.exe -q -l
  4. For more command line option, type KerberosConfigMgr.exe -h
  
  To save a server’s Kerberos configuration information:
  
  1. Connect to the target Windows machine.
  2. Click on Save button on the toolbar.
  3. Specify the location where you want the file to be saved to. It can be on a local drive or a network share.
  4. The file will be saved as XML.
  
  To view a server’s Kerberos configuration information from a saved file:
  
  1. Click on the Load button on the toolbar.
  2. Open the XML file generated by Kerberos Configuration Manager.
  
  To generate a script to fix an SPN from the command line:
  
  1. Click on the Generate button for the SPN entry.
  2. The generated script can be used by a user who has privilege to fix the SPN on the server.
  
  To see the log files for the KCM tool:
  
  1. By default, a log file is generated each time the application is executed, and placed in the user’s application data folder: %APPDATA%\Microsoft\KerberosConfigMgr
  
  Options to get help:
  
  • Hover the mouse cursor over the command for tooltip.
  • Run KerberosConfigMgr.exe –h from command line.
  • Click the Help button in the toolbar.