<p>In order to set up an SSO, you might need to create a keytab file on a Domain Controller. In this article, we&#8217;ll explain in a few simple steps how to achieve this.</p>
<p><img class="alignnone wp-image-3751 size-full" title="create a keytab file on a Domain Controller" src="https://www.wincert.net/wp-content/uploads/2020/06/source-code-583537_640.jpg" alt="create a keytab file on a Domain Controller" width="640" height="362" /></p>
<ol>
<li>Create a <strong>domain user</strong> that will be used for creating a keytab file. Make sure to check both checkboxes &#8220;<strong>User cannot change password</strong>&#8221; and &#8220;<strong>Password never expires</strong>&#8220;. Please have in mind that only one keytab file per user is allowed. In case you need more keytab files additional users have to be created.</li>
<li>Start Command Prompt (CMD) in elevated mode (Run as Administrator) and type the following command.</li>
</ol>
<ul>
<li><strong>ktpass -princ HTTP/<em>FQDN@domainname</em> -mapuser <em>username</em> -crypto ALL -ptype KRB5_NT_PRINCIPAL -pass pa$$w0rd -target FQDNofDC -out host.keytab</strong></li>
</ul>
<p>Replace <strong>FQDN@domainname</strong> with a Fully Qualified Domain Name@domainname of the target machine/application server. Example: <strong>melbourne.contoso.com@contoso.com<br />
</strong>Replace <strong>username</strong> with a username of the user you have created for this purpose in step 1.<br />
Replace <strong>pa$$w0rd</strong> with the password you have specified for this user in step 1.<br />
Replace <strong>FQDNofDC</strong> with Fully Qualified Name of your Domain Controller. Ex: <strong>Brisbane.contoso.com</strong><br />
You can also change the <strong>host.keytab</strong> file name if you wish.</p>
<p>You should receive a command completed successfully message with additional information regarding the newly created keytab file. Even though you have received a successful completion message you should also check if the SPN has been appropriately set for the application server with the following command:</p>
<p><strong>setspn -Q */FQDN</strong></p>
<p>example: <strong>setspn -Q */melbourne.contoso.com</strong></p>
<p>where <em>Melbourne</em> is the application server name. You should receive the <strong>Existing SPN found</strong> message.</p>
<p>If not specified, the keytab file will be created in the <strong>C:\Windows\System32</strong> directory which is a default location of command prompt app.</p>
<p>That&#8217;s it. Hopefully, this article will help you to create a keytab file on a Domain Controller.</p>
<p>Please share your thoughts or suggestions in the comments section below.</p>