User SPN total count should be investigated
AD-SPN-06InfoActive DirectoryService principal names
Part of Active Directory · Active Directory · Service principal names · All checks
Invoke-Maester -TestId AD-SPN-06Overview
Section titled “Overview”User accounts with Service Principal Names (SPNs) are high-value targets for attackers because:
- Kerberoasting: Attackers can request service tickets for these SPNs and attempt to crack them offline
- Service account exposure: User accounts with SPNs often have elevated privileges
- Password policy gaps: Service accounts may have weaker password policies than expected
- Shadow service accounts: Unknown user accounts with SPNs may indicate unauthorized services
Understanding the scope of user SPNs helps assess your Kerberoasting attack surface.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Minimize user accounts with SPNs:
- Use Group Managed Service Accounts (gMSAs) instead of user accounts for services
- Regularly audit user accounts with SPNs
- Ensure service accounts have strong, regularly rotated passwords
- Consider using Managed Service Accounts (MSAs) where possible
- Remove SPNs from accounts that no longer need them
How the Test Works
Section titled “How the Test Works”This test retrieves all user objects from Active Directory, extracts their SPNs, and counts the total number of SPNs configured on user accounts.
Related Tests
Section titled “Related Tests”Test-MtAdUserSpnServiceClassCount- Counts distinct service classes on usersTest-MtAdUserSpnDomainAdminCount- Identifies SPNs on domain admin accountsTest-MtAdComputerSpnTotalCount- Counts computer account SPNs
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-SPN-06 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Service principal names |
| Area | Authentication |
| Resource type | User |
| MITRE ATT&CK | T1558.003 Kerberoasting |
| PowerShell test | Test-MtAdUserSpnTotalCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:user:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/spn/Test.AD-SPN-06.ps1 - Documentation:
tests/ad/spn/Test.AD-SPN-06.md