Computer SPN unknown service class count should be retrievable
AD-SPN-03InfoActive DirectoryService principal names
Part of Active Directory · Active Directory · Service principal names · All checks
Invoke-Maester -TestId AD-SPN-03Overview
Section titled “Overview”Unidentified SPN service classes can represent security risks:
- Shadow IT: Unknown services may be running without IT’s knowledge or approval
- Misconfigurations: Typos or incorrect SPN registrations can cause authentication issues
- Malicious services: Attackers may register SPNs for rogue services
- Legacy cleanup: Old application SPNs may remain after decommissioning
Identifying unknown SPNs allows security teams to investigate and validate whether these services are legitimate and properly secured.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”When unknown SPN service classes are identified:
- Investigate each unknown service class to determine its purpose
- Verify if the service is authorized and necessary
- Check if the SPN is registered on the correct account
- Remove SPNs for unauthorized or decommissioned services
- Document any custom or third-party SPNs for future reference
How the Test Works
Section titled “How the Test Works”This test compares discovered SPN service classes against a database of known SPNs (including standard Windows services, common enterprise applications, and database systems). Service classes not in the known list are flagged as unknown.
Related Tests
Section titled “Related Tests”Test-MtAdComputerSpnUnknownDetails- Provides detailed information about unknown SPNsTest-MtAdComputerSpnServiceClassCount- Counts all distinct service classesTest-MtAdUserSpnUnknownCount- Identifies unknown SPNs on user accounts
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-SPN-03 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Service principal names |
| Area | Infrastructure hardening |
| Resource type | Computer |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdComputerSpnUnknownCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:computer:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/spn/Test.AD-SPN-03.ps1 - Documentation:
tests/ad/spn/Test.AD-SPN-03.md