After the database service was changed to run under a new domain service account, client connections that previously used Kerberos now fall back to NTLM, and double-hop delegation to a linked server fails. Which action most likely resolves this?
Select an answer to reveal the explanation.
Short Explanation
Here's what you're missing: Kerberos finds a service by its SPN, a bit like a mailbox label with the service account's name on it. Change the service account and the label still points at the old one, so tickets can't be issued and clients fall back to NTLM. Resetting user passwords is the trap; the users aren't broken, the service's label is.
Full Explanation
A service principal name identifies a service instance, such as a database service on a specific host and port, and maps it to the account the service runs under. When a client requests a Kerberos service ticket, the key distribution center looks up the SPN to find which account's key to encrypt the ticket with. If the service account changes but the SPN remains registered on the old account, or is missing or duplicated, the client cannot obtain a usable ticket and integrated authentication falls back to NTLM, which cannot support delegation for double-hop scenarios like linked servers. Registering the SPN on the new service account, removing the stale or duplicate registration, and configuring delegation where required restores Kerberos. Disabling Kerberos makes NTLM permanent, sacrificing mutual authentication and delegation, and the linked server double hop would still fail. Resetting user passwords has no effect, because the users' own Kerberos authentication is working; the problem is locating the service. Granting the service account administrator rights on workstations adds privilege without touching SPN mapping and violates least privilege. Exam caveat: duplicate SPNs across accounts also break Kerberos, so check for duplicates as well as missing entries. Operational check: list the SPNs registered for the new account, reconnect a client and confirm the session reports Kerberos authentication.