這項檢查會嘗試尋找地端 DC 的現有 Kerberos 票證。
如果失敗，系統會嘗試產生新票證做為驗證形式。
其他檢查發生錯誤可能會導致這項檢查出錯。如果解決其他檢查的失敗問題，應該就能解決這項檢查的失敗問題。
SQL Server 的 Kerberos 票證
驗證內部部署網域是否已啟用 Kerberos 驗證。系統會為您提供的每個 SQL Server 服務主體名稱 (SPN) 尋找現有的 Kerberos 票證。SQL Server 的 SPN 為 MSSQLSvc/{SQL Server FQDN}:1433。如果無法取得 SPN 的票證，Cloud SQL 會檢查是否已設定允許主機名稱中含有 IP 的 Windows 登錄值。如果已設定，請嘗試使用 SPN 取得票證
MSSQLSvc/{SQL Server IP}:1433。
詳情請參閱
Microsoft 說明文件。
這項檢查會嘗試尋找 SQL Server 的現有 Kerberos 票證。
如果失敗，系統會嘗試產生新票證做為驗證形式。
其他檢查發生錯誤可能會導致這項檢查出錯。解決其他檢查的失敗問題，應該就能解決這項檢查的失敗問題。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Active Directory Diagnosis tool for Cloud SQL\n\nThe Active Directory (AD) Diagnosis tool is a utility PowerShell script that\nhelps you to troubleshoot AD setup issues with your\non-premises domain and Cloud SQL for SQL Server instances in Google Cloud.\n\nThe tool performs various checks for issues, such as closed ports, FQDN\nlookups, and DNS issues. It runs on an on-premises Windows VM that is one of the domain\ncontrollers for your on-premises domain.\n\nThis page describes how to use the Active Directory Diagnosis tool for Cloud SQL\nand explains the checks that the\ntool performs.\n\nPrerequisites\n-------------\n\nEnsure that you have the following components set up before proceeding to use the\nAD Diagnosis tool:\n\n- An AD enabled on-premises domain.\n- A Managed AD domain in Google Cloud console.\n- A Cloud SQL for SQL Server instance joined to the Managed AD domain.\n\nHow to use the AD Diagnosis tool\n--------------------------------\n\nTo use the AD Diagnosis tool, perform the following steps:\n\n1. Log on to any one of the on-premises domain controllers or a VM joined to the on-premises domain.\n2. [Download the `diagnose_ad.ps1`\n script](https://github.com/GoogleCloudPlatform/cloud-sql-active-directory-diagnosis-tool/blob/main/diagnose_ad.ps1) on the VM.\n3. Launch Powershell as Administrator.\n4. Run the `diagnose_ad.ps1` script in the Powershell window using the following\n command:\n\n powershell -command \"& { . C:\\\\\u003cvar\u003eSCRIPT_PATH\u003c/var\u003e\\\\diagnose_ad.ps1; Run-Tool }\"\n\n5. Enter the following information when prompted:\n\n | **Note:** Some checks require administrator privileges. If you didn't launch Powershell as Administrator earlier, you are prompted to choose to run it as Administrator.\n - On-premises domain name, such as `my-onprem-domain.com`\n - Managed AD domain name, such as `my-ad-domain.com`\n - List of SQL Server Active Directory FQDNs and private IP addresses. This list is available in the Google Cloud console on the instance's **Overview** page.\n\nThe tool then performs a number of checks, as described in [Checks performed by the AD Diagnosis tool](/sql/docs/sqlserver/ad-diagnosis-tool#checks).\n\nChecks performed by the AD Diagnosis tool\n-----------------------------------------\n\nWhat's Next\n-----------\n\n- To share your feedback, you can use [GitHub Issues](https://github.com/GoogleCloudPlatform/cloud-sql-active-directory-diagnosis-tool/issues)."]]
