At work we use Microsoft Windows Sharepoint Services (WSS) for our intranet. It’s pretty good free software if you already have Windows Server and works well in MS land. It integrates really nicely with Office (if you have the latest version), but if you are two versions behind, you lose out on a lot of features.

The architecture of our setup is a little complicated; we have two web servers in a Network Load Balanced web farm, a separate database server, and Kerberos authentication to Active Directory. Everything has been running swimmingly for the last few years, but recently we noticed an annoying problem.

Whenever a user searches the intranet, WSS returns “No results found”. Investigating the Event Viewer on the web server shows an error whenever the search service is meant to be indexing.

This is the infamous Error 2436 (well, infamous if you’ve done any searching for WSS search errors). This error is quite misleading, as it sends you on a wild goose-chase of checking user accounts, permissions, passwords and so on. It turns out that there are many possible fixes for this, but none of them worked in our situation.

Various fixes include;

• DisableLoopbackCheck
• Setting the authentication of the site collection to NTLM instead of Kerberos

However, none of them worked.

Eventually I noticed a Kerberos error in the Event Viewer that roughly corresponded to the error above.

The error shows that there is a missing Service Principal Name (SPN) for the server name shown (pixelized for anonymity). The account that search runs on therefore needs an SPN set for the http service and the corresponding server name shown in the event viewer. The required SPN is in the form “http/intranet.domain.com”.

I found a really great tool called DelegConfig that helps with the arduous task of viewing, deleting and setting SPNs which you can find here;

http://blogs.iis.net/bretb/archive/2008/03/27/How-to-Use-DelegConfig.aspx

A minute later I had set the required SPN, kicked off a new search and I finally had results showing on intranet searches!