nerdexam

70-158 · Question #93

You use Forefront Identity Manager (FIM) 2010 in your company network. You configure Password Change Notification Service (PCNS) between an Active Directory Domain Services (AD DS) domain named…

The correct answer is B. Verify that the SPN has been assigned to a single AD account. The RPC exception error indicating "The target principal name is incorrect" is a common Kerberos authentication issue that frequently stems from a duplicate Service Principal Name (SPN) registration.

Submitted by andreas_gr· Mar 4, 2026Configuring Password Management

Question

You use Forefront Identity Manager (FIM) 2010 in your company network. You configure Password Change Notification Service (PCNS) between an Active Directory Domain Services (AD DS) domain named contoso.com and an Active Directory Lightweight Directory Services (AD LDS) instance. The FIM Service is hosted on a server named FIM-Srv-1. After you change the password for an AD account, you receive the following RPC exception error: ProcessID is 3252 System Time is: 7/22/2009 9:8:43:109 Generating component is 3 Status is -2146893022 - The target principal name is incorrect. Detection location is 150 Flags is 0 NumberOfParameters is 3 Long val: 16 Long val: 6 Long val: 0 You verify the following requirements: - The DNS is resolving names correctly. - The SPN for the target has been assigned to an AD account used to host the target process. - Time clocks are synchronized to an authoritative time source. You need to identify the cause of the error. What should you do?

Options

  • AVerify that Port 135 is open between endpoints.
  • BVerify that the SPN has been assigned to a single AD account.
  • CFrom the command prompt, run setSPN.exe _ L FIMSvc.
  • DFrom the command prompt, run setSPN.exe _ a PCNSCLNT/FIM-Srv-1.contoso.com contoso\FIMSvc.

How the community answered

(28 responses)
  • A
    14% (4)
  • B
    57% (16)
  • C
    25% (7)
  • D
    4% (1)

Why each option

The RPC exception error indicating "The target principal name is incorrect" is a common Kerberos authentication issue that frequently stems from a duplicate Service Principal Name (SPN) registration.

AVerify that Port 135 is open between endpoints.

While RPC communication relies on open ports, this specific error message indicates an authentication issue rather than a basic network connectivity or port blockage problem.

BVerify that the SPN has been assigned to a single AD account.Correct

This error (Status is -2146893022 - "The target principal name is incorrect") is a classic Kerberos authentication error. Even if an SPN has been assigned, if the *same* SPN is registered to multiple Active Directory accounts, the Kerberos Key Distribution Center (KDC) cannot uniquely identify the service, leading to authentication failure. Therefore, verifying the SPN's uniqueness is a critical step in diagnosing this specific error.

CFrom the command prompt, run setSPN.exe _ L FIMSvc.

Running `setSPN.exe -L FIMSvc` would list SPNs for a specific account, which is a diagnostic step, but it doesn't directly identify the *cause* of an "incorrect target principal name" as effectively as checking for duplicate registrations.

DFrom the command prompt, run setSPN.exe _ a PCNSCLNT/FIM-Srv-1.contoso.com contoso\FIMSvc.

Adding an SPN (`setSPN.exe -a`) is an action to *configure* an SPN, not to *identify the cause* of an existing "incorrect target principal name" error, especially when the problem might be a duplicate SPN.

Concept tested: Kerberos authentication, duplicate SPN troubleshooting

Source: https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/duplicate-spn-causes-authentication-failure

Topics

#PCNS#SPN#FIM 2010#Troubleshooting

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 70-158 Practice