MBAM 2.5 - Websites on Port 81 - SPN Question / Kerberos Issues?

Question

Because I'm installing the websites on a server that also has a ConfigMgr DP and MP, I'm picking a custom port during installation (port 81).  I pre-created the SPN with http/my.server.name:81 but I'm still having issues.
The installer still complains about not being able to create the SPN itself since I'm not installing as a domain administrator.  However, the warnings and log messages all say it is trying to create an SPN without the port number (http:/my.server.name).
Unfortunately, the MBAM clients are not able to check in and show errors with Event ID 2 and 4 the MBAM logs:
An error occurred while applying MBAM policies.
Volume ID:\\?\Volume{7c3de574-d716-11e3-810f-f8b156dde320}\
Error code:
0x803d0005
Details:
Access was denied by the remote endpoint.
And
An error occurred while sending encryption status data.
Error code:
0x803d0005
Details:
Access was denied by the remote endpoint.
I also get a Security-Kerberos error eventID 4 in the System Log:
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server mbam-apppooluser. The target name used was HTTP/my.server.name. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Please ensure that the target SPN is registered on, and only registered on, the account used by the server. This error can also happen when the target service is using a different password for the target service account than what the Kerberos Key Distribution Center (KDC) has for the target service account. Please ensure that the service on the server and the KDC are both updated to use the current password. If the server name is not fully qualified, and the target domain (my.domain) is different from the client domain (my.domain), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.
The group policies point at my.server.name:81 so I'm wondering why Kerberos is coming back with an error for http/my.server.name.
Was I not supposed to include the port number in the SPN?  Has anyone actually tried MBAM 2.5 on an alternative port?
Thanks for the help,
Nash
Nash Pherson, Senior Systems Consultant
Now Micro -
My Blog Posts
If you've found a bug or want the product worked differently,
share your feedback.
<-- If this post was helpful, please click "Vote as Helpful".

Answer 1

The user is a member of both those groups.  Entering the user credentials does not get into the website anymore.
I've actually moved to a clean server and installed on port 80 to take this SPN issue off the table, and not deal with the websites not working anymore.  The clean server's web sites are accessible after signing in.
Unfortunately, although the test clients no longer show a Kerberos error in the System event logs,
the MBAM client event logs still have the 0x803d0005 error.  I don't see any errors on the MBAM Server operational logs.
The IIS logs show the request to /MBAMRecoveryAndHardwareService/CoreService.svc having a status of 200, but the request to /MBAMComplianceStatusService/StatusReportingService.svc is showing status 401.
Thoughts?
Nash Pherson, Senior Systems Consultant
Now Micro -
My Blog Posts
If you've found a bug or want the product worked differently,
share your feedback.
<-- If this post was helpful, please click "Vote as Helpful".