Integrated Dell Remote Access Controller 9 Version 3.15.15.15 User's Guide

Generating Kerberos keytab file

1. Run the ktpass utility on the domain controller (Active Directory server) where you want to map iDRAC to a user account in Active Directory.
2. Use the following ktpass command to create the Kerberos keytab file:

   C:\> ktpass.exe -princ HTTP/idrac7name.domainname.com@DOMAINNAME.COM -mapuser DOMAINNAME\username -mapOp set -crypto AES256-SHA1 -ptype KRB5_NT_PRINCIPAL -pass [password] -out c:\krbkeytab 

   The encryption type is AES256-SHA1. The principal type is KRB5_NT_PRINCIPAL. The properties of the user account to which the Service Principal Name is mapped to must have Use AES 256 encryption types for this account property enabled.

   NOTE:Use lowercase letters for the iDRACname and Service Principal Name. Use uppercase letters for the domain name as shown in the example.
3. Run the following command:

   C:\>setspn -a HTTP/iDRACname.domainname.com username

   A keytab file is generated.

   NOTE:If you find any issues with iDRAC user for which the keytab file is created, create a new user and a new keytab file. If the same keytab file which was initially created is again executed, it does not configure correctly.