Computer SPN service class usage should be retrievable
AD-SPN-02InfoActive DirectoryService principal names
Part of Active Directory · Active Directory · Service principal names · All checks
Invoke-Maester -TestId AD-SPN-02Overview
Section titled “Overview”Understanding the distribution of SPN service classes across your computer infrastructure provides valuable security insights:
- Service inventory: See what services are deployed across your environment
- Risk assessment: Identify high-value targets (like database services with SPNs)
- Compliance tracking: Ensure only approved services are configured
- Anomaly detection: Spot unusual service classes that may indicate shadow IT or misconfigurations
Services with SPNs are targets for Kerberoasting attacks, so knowing which services exist helps prioritize security efforts.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Review the service class breakdown regularly:
- Validate that all services with SPNs are authorized
- Ensure sensitive services (MSSQLSvc, etc.) have additional protections
- Remove SPNs for decommissioned services
- Consider implementing SPN attribution monitoring for critical services
How the Test Works
Section titled “How the Test Works”This test analyzes all computer SPNs, groups them by service class, and provides a count and percentage for each service class. This gives you a clear view of your Kerberos-authenticated service landscape.
Related Tests
Section titled “Related Tests”Test-MtAdComputerSpnServiceClassCount- Counts distinct service classesTest-MtAdComputerSpnUnknownCount- Identifies unrecognized service classesTest-MtAdUserSpnServiceClassUsage- Shows user account SPN service class usage
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-SPN-02 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Service principal names |
| Area | Infrastructure hardening |
| Resource type | Computer |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdComputerSpnServiceClassUsage |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:computer:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/spn/Test.AD-SPN-02.ps1 - Documentation:
tests/ad/spn/Test.AD-SPN-02.md