Protected user accounts are not able to log into the CA Client (4346962)

Adding a user account to the protected users group causes the protected user to not be able to log into the CA client.

The following error message can be seen in the client log file:

This type of error typically indicates that there is some issue preventing the protected account from being able to use Kerberos in the environment.

• Make sure you have fully logged out with the protected user account after adding them to the protected users security group.  This ensures that the account generates a new token to be used.
• Make sure that the clock on the host is synchronized with those of the domain controllers.
• Use ADSIEdit to check the servicePrincipalName attribute on the computer account(s) hosting your coordinator software in your domains.  You should see that there is an NPRepository4 entry and what the entries full value is.

• DEFAULT is the name of your CA Installation
• myhost.domain.local is the FQDN of your coordinator
• myhost is the hostname of your coordinator (short name)

• If you find that there is no NPRepository4 entry, you have to add the SPN to the computer object by doing the following on a domain controller:

Use the setspn utility by running the following command from a DC: