Hello - sorry if this is the wrong forum, but since it deals with printers shared over SMB, I thought it might fit in the "file services" section.
We have 500 users using \\print2008 to print right now, so I can't just stand up the new machine, \\print2016 and immediately change our DNS server to have a CNAME pointing print2008 to the new print2016 machine until I'm sure everything works.
So I thought that perhaps I could use the hosts file on my office workstation to do a simple alias.
I stick:
<ip address> print2008
<ip address>print2008.fqdn
into the hosts file and just hope it will work.
However, sadly, none of my printers previously mapped to print2008 are working on my workstation post reboot. Whenever I try to print, I get a GUI-based "access is denied error" and in Event Viewer, I get the following:
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server print2016$. The target name used was host/print2008. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password.
So, I'm guessing that for security's sake, print2016 is refusing to handle my requests because my workstation is offering them to print2008. I followed what instructions I was able to from
here, like turning off StrictNameChecks and turning on DNSonWire. I also added the BackConnectionHostNames entry. Basically everything that didn't give me an error message, but I couldn't do the dreaded SPN record for kerberos authentication.... because
of course, I get the "duplicate SPN found, aborting operation!" error.
Of course there's a duplicate SPN; print2008 is being used by 500 users!
If I was 100% sure that everything was working great on print2016 I'd go ahead and just make the changes in DNS, like adding the CNAME record that the link in the previous paragraph describes, but I can't riskanything happening to print2008 when it's in active use.
Can anyone recommend a good way to set up my testing environment so I can basically fool my workstation into being okay with sending "bad" kerberos tickets to print2016, and have print2016 be okay with accepting them?
Thanks.