Duplicate SPN Active Directory issues cause Kerberos authentication to fall back to NTLM, a weaker protocol vulnerable to relay attacks, pass-the-hash, and brute force cracking. Finding and removing duplicate SPNs is a straightforward fix that most environments overlook entirely. What is a Service Principal Name? Service principal names (SPN) is used by Kerberos to link a service to a service account. This allows a user to access a service without knowing the service account