The Application Pool Account Must Be Registered As A Kerberos Service Provider

Microsoft.SharePoint.2016.The_application_pool_account_must_be_registered_as_a_Kerberos (Rule)

This Rule collects data when the application pool account has insufficient permissions to add user accounts to Active Directory. When using Kerberos authentication, the service account used by the Internet Information Services (IIS) application pool for your Web application must be registered in Active Directory as a Service Principal Name (SPN) on the domain on which the Web front-end is a member.

Knowledge Base article:

Summary

To get the most current Knowledge Article from the Microsoft TechNet site, visit:

http://go.microsoft.com/fwlink/?LinkId=245037

Causes

View all current alerts from this object using this link:

View Alerts

Element properties:

Target

Microsoft.SharePoint.2016.SPServer

Category

EventCollection

Enabled

True

Event_ID

6590

Event Source

Microsoft-SharePoint Products-SharePoint Foundation

Alert Generate

True

Alert Severity

Warning

Alert Priority

Normal

Remotable

True

Alert Message

SharePoint: Web Application Invalid Application Pool Account

A warning incident occurred due to a web application invalid Application Pool account on server {2}.

Event ID: {0}
Event Description: {1}

Event Log

Microsoft-SharePoint Products-Shared/Operational

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventProvider	Default
Alert	WriteAction	System.Health.GenerateAlert	Default
WriteToDB	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
WriteToDW	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default

Source Code:

<Rule ID="Microsoft.SharePoint.2016.The_application_pool_account_must_be_registered_as_a_Kerberos" Enabled="true" Target="MOSS16Core!Microsoft.SharePoint.2016.SPServer" ConfirmDelivery="false" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Microsoft-SharePoint Products-Shared/Operational</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">6590</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">Microsoft-SharePoint Products-SharePoint Foundation</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

    <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertMessageId>$MPElement[Name="Microsoft.SharePoint.2016.The_application_pool_account_must_be_registered_as_a_Kerberos.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDisplayNumber$</AlertParameter1>

        <AlertParameter2>$Data/EventDescription$</AlertParameter2>

        <AlertParameter3>$Target/Property[Type="MOSS!Microsoft.SharePoint.Library.SPServer"]/ComputerID$</AlertParameter3>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/Params/Param[1]$</SuppressionValue>

      </Suppression>

    </WriteAction>

  </WriteActions>

</Rule>