Computer SPN service class count should be retrievable
AD-SPN-01InfoActive DirectoryService principal names
Part of Active Directory · Active Directory · Service principal names · All checks
Invoke-Maester -TestId AD-SPN-01Overview
Section titled “Overview”Service Principal Names (SPNs) are critical for Kerberos authentication in Active Directory. Understanding the distribution of SPN service classes helps security teams:
- Identify service exposure: Know what services are exposed for Kerberos authentication
- Detect anomalies: Unusual SPN service classes may indicate unauthorized services or misconfigurations
- Audit service footprint: Track the services running across your infrastructure
- Kerberoasting assessment: SPNs are required for Kerberoasting attacks; knowing what exists helps assess risk
Common SPN service classes include HOST, HTTP, LDAP, MSSQLSvc, and CIFS. Unexpected service classes may warrant investigation.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Regularly audit SPN configurations to ensure:
- Only authorized services have SPNs registered
- SPNs are registered on the correct accounts
- Unused or legacy service SPNs are removed
- Sensitive SPNs (like those for database services) are properly secured
How the Test Works
Section titled “How the Test Works”This test retrieves all computer objects from Active Directory, extracts their SPNs, and counts the distinct service classes. An SPN has the format serviceclass/host:port, and this test focuses on the service class portion.
Related Tests
Section titled “Related Tests”Test-MtAdComputerSpnServiceClassUsage- Shows usage breakdown of each service classTest-MtAdComputerSpnUnknownCount- Identifies unrecognized SPN service classesTest-MtAdUserSpnServiceClassCount- Counts distinct service classes on user accounts
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-SPN-01 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Service principal names |
| Area | Infrastructure hardening |
| Resource type | Computer |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdComputerSpnServiceClassCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:computer:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/spn/Test.AD-SPN-01.ps1 - Documentation:
tests/ad/spn/Test.AD-SPN-01.md