Kerberos-FEATURE_USE_CNAME_FOR_SPN

Kerberos-FEATURE_USE_CNAME_FOR_SPN_KB911149 is a Volvo IT configuration package that enables Windows clients to use the DNS canonical name (CNAME) when constructing Kerberos Service Principal Names (SPNs), as described in Microsoft KB 911149. By honoring CNAME aliases, it helps maintain seamless single sign-on for applications accessed via DNS aliases or load balancers, reducing unwanted fallbacks to NTLM.

Key points:

Applies the FEATURE_USE_CNAME_FOR_SPN_KB911149 feature-control setting for selected processes (both 32-bit and 64-bit) via registry configuration.
No user interface; installs silently. An application restart is typically sufficient; a full system reboot is rarely required.
Client-side only: it does not modify domain SPNs, service accounts, or KDC settings—just how the client builds SPNs.
Ideal for scenarios where users access services through aliases (for example, portal URLs, reverse proxies, or load-balanced VIPs) and Kerberos should remain the preferred authentication protocol.

Prerequisites and compatibility:

Requires Windows versions that support the FEATURE_USE_CNAME_FOR_SPN_KB911149 feature-control key.
Assumes correct SPN registration on target services and reliable DNS resolution.

Security note:

Using CNAMEs for SPN construction is safe when DNS and SPN registrations are properly managed. Validate in a test environment before broad deployment.

Kerberos-FEATURE_USE_CNAME_FOR_SPN_KB911149 is developed by Volvo IT. The most popular version of this product among our users is 1.0.

You can check MIT Kerberos, KML Feature Extractor, Feature Extraction and other related programs like Kerberos Telnet at the "download" section.