Hi Carl,
That host one looks strange to me, as far as I know the host SPNs are created only for the computer accounts in the domain (automatically). Did you add that yourself at any point?
Also what is the purpose of the following service accounts:
- lancast-office\ntservices
- lancast-office\gmsa-crm
If the second one isn't used I would try removing that host SPN
setspn -d host/crm.xxxx.xxx lancast-office\gmsa-crm
Also check what SPNs are on the computer account by
setspn -l server-crm
If you don't see any HTTP/SERVER-CRM SPNs, it might be worth adding them to see if it helps
setspn -s HTTP/SERVER-CRM crmserviceaccount
setspn -s HTTP/SERVER-CRM.lancast-office.local crmserviceaccount
setspn -s HTTP/crm.xxxx.xxx crmserviceaccount
The -s switch is to add an SPN but it checks to make sure it doesn't exist already, if the SPN already exists it won't be created. That's why it's better than the -a switch which just blindly adds the SPN.
You can replace the -s switch with a -d switch to delete the SPN as well.
When adding SPNs it can take up to 15 minutes for them to propagate.
So steps I would take are;
1. Remove the host spn from the gmsa-crm account with the setspn -d command above
2. Check the SPNs on the server-crm computer account with the setspn -l command above
3. Check the CRMAppPool identity in IIS, is this a domain account or NETWORK SERVICE?
4. Check if there are any duplicate SPNs on your network by running: setspn -x
5. Run the setspn -s commands above, substitute crmserviceaccount for the domain account found in step 3, if it is NETWORK SERVICE or something else let me know.
6. If there are no errors adding the SPNs, set useAppPoolCredentials = true in IIS(blogs.technet.com/.../useapppoolcredentials-true-with-kerberos-delegation-on-2008.aspx)
7. Trust the crm service account for delegation in Active Directory
8. Perform an IIS reset
9. Wait 15 minutes, see if you can now access
Also, it is important to keep track of any changes you make and the order you make them, write them down somewhere. That way if you need to revert it will be much easier.
Useful reading: devbeard.com/crm-2013-kerberos-and-spn-checklist
