Allow IP address-based SPNs during Kerberos authentication
- Policy ID
- EnableTryIPSPN
- Scope
- Computer Configuration
- Supported on
- At least Windows 11 Version 24H2
- Source
- Administrative Templates (.admx) for Windows 11 2026 Update (26H2) (version 1.0)
- Category
- System › Kerberos
Description
This policy setting allows you to configure Kerberos to use IP address-based service principal names (SPNs).
If you enable this policy setting, the Kerberos client will attempt to use IP address-based SPNs when connecting to a service.
If you disable or do not configure this policy setting, Kerberos will not attempt to use IP address-based SPNs.
Registry
ComputerHKEY_LOCAL_MACHINE
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters View registry values
- TryIPSPNREG_DWORD