Skip to main content
Version: 2.2.1-preview

AD-SPN-05 - Computer SPN non-FQDN hosts should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

SPNs should use fully qualified domain names (FQDNs) for the host portion to ensure proper Kerberos authentication across domain boundaries and to avoid ambiguity. Non-FQDN hosts can cause:

  • Authentication failures: Kerberos may fail to find the correct service principal
  • DNS resolution issues: Short names may not resolve correctly in all contexts
  • Cross-domain problems: Non-FQDNs may not work across domain trusts
  • Configuration drift: Indicates inconsistent SPN registration practices

Security Recommendation​

Review SPNs with non-FQDN hosts:

  • Determine if the SPN is still needed
  • Update SPNs to use FQDN format (serviceclass/host.fqdn:port)
  • Establish standards for SPN registration in your organization
  • Use FQDNs consistently for all service principal names

How the Test Works​

This test parses all computer SPNs and checks if the host portion contains a dot (indicating FQDN format). SPNs without dots in the host portion are flagged as non-FQDN.

  • Test-MtAdUserSpnNonFqdnHosts - Checks user account SPNs for non-FQDN hosts
  • Test-MtAdComputerSpnServiceClassCount - Overall SPN analysis

Test Metadata​

FieldValue
Test IDAD-SPN-05
SeverityInfo
SuiteActive Directory
CategoryAD.SPN
PowerShell testTest-MtAdComputerSpnNonFqdnHosts
TagsAD, AD-SPN-05, AD.SPN

Source​

  • Pester test: tests/ad/spn/Test-MtAdComputerSpnNonFqdnHosts.Tests.ps1
  • PowerShell source: powershell/public/ad/spn/Test-MtAdComputerSpnNonFqdnHosts.ps1