if you find this on your event logs on your Active Directory Domain Controller:
Event ID: 11, Source: Kerberos-Key-Distribution-Center
The KDC encountered duplicate names while processing a Kerberos authentication request. The duplicate name is host/hostname.domain.local (of type DS_SERVICE_PRINCIPAL_NAME). This may result in authentication failures or downgrades to NTLM. In order to prevent this from occuring remove the duplicate entries for host/name.domain.local in Active Directory.
you have a host entry on your Computers Container that have the same service principal name
to check which computers/host have the duplicate principal names run
ldifde -f duplicateSPN.txt -t 3268 -d “” -l servicePrincipalName -r “(servicePrincipalName=HOST/host.domain.local*)” -p subtree
replace HOST/host.domain.local with the name on the event log, duplicateSPN.txt can be any name as well, the output of ldifde will be saved here so you can parse it easier on notepad or any text editor later.
once you have opened this file you will be presented with something like
dn: CN=host.domain.local,CN=Computers,DC=domain,DC=local
changetype: add
servicePrincipalName: HOST/host
servicePrincipalName: HOST/host.domain.local
dn: CN=host2,CN=Computers,DC=domain,DC=local
changetype: add
servicePrincipalName: HOST/host.domain.local
servicePrincipalName: HOST/host2.domain.local
or more entries will show up that have the same service principal name, if you know which of these hosts are no longer active, you can safely delete it.