SPN suffixes count should be retrievable
AD-FORS-03InfoActive DirectoryDomain and forest
Part of Active Directory · Active Directory · Domain and forest · All checks
Invoke-Maester -TestId AD-FORS-03Overview
Section titled “Overview”SPN (Service Principal Name) suffixes simplify Service Principal Name management in complex Active Directory environments. They are important for:
- Service Authentication: SPNs are used by Kerberos to authenticate services; suffixes provide flexibility in how services are registered
- Multi-Domain Services: Organizations hosting services across multiple DNS namespaces use SPN suffixes to simplify SPN registration
- Service Migration: SPN suffixes enable service migration between domains without changing service configurations
- Security Assessment: Understanding SPN suffix configuration helps identify potential Kerberos authentication attack surfaces
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Review SPN suffix configuration regularly:
- Ensure only legitimate organizational DNS domains are configured as SPN suffixes
- Remove unused SPN suffixes that may have been added for completed projects
- Verify that SPN suffixes align with the organization’s service hosting strategy
- Monitor for unauthorized SPN suffix additions which could indicate compromise
How the Test Works
Section titled “How the Test Works”This test retrieves the SPN suffixes configured at the forest level using the Get-ADForest cmdlet. It counts the number of custom SPN suffixes and reports the configuration status. The default forest domain is available for SPN registration by default and is not counted as a custom suffix.
Related Tests
Section titled “Related Tests”Test-MtAdUpnSuffixesCount- Checks UPN suffix configuration for user authenticationTest-MtAdUpnSuffixesDetails- Provides detailed UPN suffix information
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-FORS-03 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Domain and forest |
| Area | Infrastructure hardening |
| Resource type | Tenant |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdSpnSuffixesCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:crossRef:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/domain/Test.AD-FORS-03.ps1 - Documentation:
tests/ad/domain/Test.AD-FORS-03.md