You are working with GroupShare and have set the SPN as explained in the Installation Guide or How do I configure the Windows Authentication for SDL Trados GroupShare 2017 (or higher).

In Trados Studio 2021 and Trados Studio 2022, opening a Translation Memory will only display the list of Organizations, no TMs listed.

When trying to use a GroupShare translation memory, you receive following error:

There was a connection protocol error.
Please check that you have entered the correct port number and other settings.



The error details list following additional errors:

One or more errors occurred.

An error occurred while sending the request.

The remote server returned an error: (401) Unauthorized.

The target principal name is incorrect
 

Solution: Disable IIS Windows Authentication for GS Website

This solution needs to be applied on the server where the GroupShare web server is installed (by a system administrator).

1. Start Internet Information Services (IIS) Manager
2. Expand instance node and go to Sites > SDL Server
3. In the Features View, open the Authentication feature
4. Right click Windows Authentication and select Disable
5. Restart IIS (i.e. the service World Wide Web Publishing Service). Important: This will make all websites hosted on the IIS instance briefly unavailable.

Notes:

• If you do not see Windows Authentication in step 4, this KB article does not apply to your situation.
• If Windows Authentication is already disabled, you may want to restart IIS (step 5) to ensure the issue does not persist from Windows Authentication being previously enabled.

Workaround (Trados 2017 only): Use Feature to Authenticated with Different User

1. Go to File > Setup > Servers
2. Select your server
3. Click Edit
4. Ensure that Use Windows Authentication is enabled
5. Enable Authenticate with a different user
6. Enter your Windows user name and password and confirm

Windows authentication is enabled for the "SdlServer" website in IIS.

How do I configure the Windows Authentication for SDL Trados GroupShare 2017 (or higher)

Further analysis:
When enabling Kerberos logging (https://support.microsoft.com/en-us/help/262177/how-to-enable-kerberos-event-logging; also works for newer windows versions than listed in the article), an KRB_AP_ERR_MODIFIED error with Server Name: [machine name]$ is logged in the Windows System logs (see Event Viewer). This applies if the IIS Application Pool "SdlServer" is running under Application Pool Identity or a different machine account.
Notes:

• If the SPN is not set (correctly), a KRB_AP_ERR_MODIFIED message generally specifies Server Name: [GroupShare service account] instead.
• A KDC_ERR_S_PRINCIPAL_UNKNOWN with  Server Name: identity.sdl.com is logged in any case and can be ignored.