Windows Authentication KRB5KRB_AP_ERR_MODIFIED

Solution 1:

It's possible for a duplicate SPN to cause this issue...

setspn -X

...will show you if there are any duplicates in your domain and you will need to remove the offending one. Or you could use the SPN Query Utility. I'm also assuming you've already modified the delegation tab in AD for the service account so it's trusted for delegation?

Solution 2:

I recently had the same issue.

It turned out to be SPN related. The SPN had been mapped to the machine account of the SQL Server instead of mapped to the service account that was running SQL Server.

We deleted and recreated the SPN - mapped to the service account running SQL Server 2012R2 on the host and everything was gravy.