Computer SPN non-FQDN hosts should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Service principal names · All checks

Run this check

Invoke-Maester -TestId AD-SPN-05

Overview

SPNs should use fully qualified domain names (FQDNs) for the host portion to ensure proper Kerberos authentication across domain boundaries and to avoid ambiguity. Non-FQDN hosts can cause:

• Authentication failures: Kerberos may fail to find the correct service principal
• DNS resolution issues: Short names may not resolve correctly in all contexts
• Cross-domain problems: Non-FQDNs may not work across domain trusts
• Configuration drift: Indicates inconsistent SPN registration practices

Control Type

Operational

Security Recommendation

Review SPNs with non-FQDN hosts:

• Determine if the SPN is still needed
• Update SPNs to use FQDN format (serviceclass/host.fqdn:port)
• Establish standards for SPN registration in your organization
• Use FQDNs consistently for all service principal names

How the Test Works

This test parses all computer SPNs and checks if the host portion contains a dot (indicating FQDN format). SPNs without dots in the host portion are flagged as non-FQDN.

Related Tests

• Test-MtAdUserSpnNonFqdnHosts - Checks user account SPNs for non-FQDN hosts
• Test-MtAdComputerSpnServiceClassCount - Overall SPN analysis

Details

Every attribute of this check

Field	Value
Test ID	AD-SPN-05
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Service principal names
Area	Infrastructure hardening
Resource type	Computer
MITRE ATT&CK	None
PowerShell test	Test-MtAdComputerSpnNonFqdnHosts
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:computer:ReadProperty

Source

• Test: tests/ad/spn/Test.AD-SPN-05.ps1
• Documentation: tests/ad/spn/Test.AD-SPN-05.md