User SPN unknown service class count should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Service principal names · All checks

Run this check

Invoke-Maester -TestId AD-SPN-09

Overview

Unknown SPN service classes on user accounts require immediate attention because:

• High risk: User accounts with SPNs are Kerberoasting targets
• Shadow IT: Unknown services may bypass security controls
• Misconfigurations: Could indicate improper SPN registration
• Compliance issues: Unauthorized services violate security policies

User accounts are preferred targets for Kerberoasting, making unknown SPNs on these accounts particularly concerning.

Control Type

Operational

Security Recommendation

Investigate all unknown SPNs on user accounts:

• Determine the service owner and business justification
• Verify if the service requires a user account or can use gMSA
• Check for misconfigurations or typos
• Remove unauthorized SPNs immediately
• Document approved custom SPNs

How the Test Works

This test compares discovered user SPN service classes against a database of known SPNs and flags any unrecognized service classes for investigation.

Related Tests

• Test-MtAdUserSpnUnknownDetails - Detailed information about unknown user SPNs
• Test-MtAdComputerSpnUnknownCount - Unknown SPNs on computer accounts
• Test-MtAdUserSpnServiceClassCount - All user SPN service classes

Details

Every attribute of this check

Field	Value
Test ID	AD-SPN-09
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Service principal names
Area	Authentication
Resource type	User
MITRE ATT&CK	T1558.003 Kerberoasting
PowerShell test	Test-MtAdUserSpnUnknownCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:user:ReadProperty

Source

• Test: tests/ad/spn/Test.AD-SPN-09.ps1
• Documentation: tests/ad/spn/Test.AD-SPN-09.md