SPN mappings should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Directory configuration · All checks

Run this check

Invoke-Maester -TestId AD-CFG-03

Overview

SPN mappings are used to support legacy or non-FQDN client behavior by mapping service principal names to the correct Kerberos realm/host context. While this can improve compatibility, misconfigured SPN mappings can create security and reliability issues, such as:

• Authentication inconsistencies (Kerberos vs. fallback behaviors)
• Clients receiving unexpected service identity resolution
• Increased exposure to credential forwarding / downgrade-style scenarios if legacy behavior is unintentionally permitted

Control Type

Operational

Security Recommendation

• Keep SPN mappings as minimal as possible—only those required for supported legacy interoperability.
• Periodically review and remove stale mappings tied to retired hostnames/services.
• Validate that SPN mappings resolve to the correct target identities (FQDN/realm) for all required workloads.

How the Test Works

This test inspects the SPN mapping configuration exposed by AD, extracts the configured mappings, and provides a count/visibility metric so administrators can identify whether mappings exist that should not be present.

Related Tests

• Test-MtAdWellKnownSecurityPrincipalsCount - Identifies additional security principal surface that should be consistent with Kerberos hardening.

Details

Every attribute of this check

Field	Value
Test ID	AD-CFG-03
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Directory configuration
Area	Infrastructure hardening
Resource type	Tenant
MITRE ATT&CK	None
PowerShell test	Test-MtAdSpnMappings
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:Configuration/*:ReadProperty

Source

• Test: tests/ad/config/Test.AD-CFG-03.ps1
• Documentation: tests/ad/config/Test.AD-CFG-03.md