Example command
Ktpass +rndPass -ptype KRB5_NT_SRV_HST -princ
HTTP/myilo.somedomain.net@SOMEDOMAIN.NET -mapuser myilo$@somedomain.net
-out myilo.keytab
Example output
Targeting domain controller: domaincontroller.example.net
Using legacy password setting method
Successfully mapped HTTP/iloname.example.net to iloname.
WARNING: pType and account type do not match. This might cause problems.
Key created.
Output keytab to myilo.keytab:
Keytab version: 0x502
keysize 69 HTTP/iloname.example.net@EXAMPLE.NET ptype 3
(KRB5 _NT_SRV_HST) vno 3 etype 0x17 (RC4-HMAC) keylength 16
(0x5a5c7c18ae23559acc2 9d95e0524bf23)
The Ktpass command might display a message about not being able to set the UPN. This result is
acceptable because iLO is a service, not a user. You might be prompted to confirm the password change
on the computer object. To close the window and continue creating the keytab file, click OK.
Setspn
Syntax
Setspn [options]
Description
The Setspn command displays, modifies, and deletes SPNs.
Parameters
-A <SPN>
Specifies an SPN to add.
-L
Lists the current SPN for a system.
Example command
SetSPN -A HTTP/myilo.somedomain.net myilo
The SPN components are case-sensitive. The primary (service type) must be in uppercase letters, for
example, HTTP. The instance (iLO hostname) must be in lowercase letters, for example,
myilo.somedomain.net.
The SetSPN command might display a message about not being able to set the UPN. This result is
acceptable because iLO is a service, not a user. You might be prompted to confirm the password change
on the computer object. Click OK to close the window and continue creating the keytab file.
Verifying that your environment meets the Kerberos authentication time
requirement
For Kerberos authentication to function properly, the date and time must be synchronized between the
iLO processor, the KDC, and the client workstation. Set the date and time in iLO with the server, or obtain
the date and time from the network by enabling the SNTP feature in iLO.
Setspn 309