No domain admin accounts should have SPNs configured
AD-SPN-12CriticalActive DirectoryService principal names
Part of Active Directory · Active Directory · Service principal names · All checks
Invoke-Maester -TestId AD-SPN-12Overview
Section titled “Overview”Domain administrator accounts with SPNs represent the highest possible Kerberoasting risk:
- Maximum privileges: Domain admins have unrestricted access to the entire domain
- Golden ticket risk: Compromising a domain admin can lead to complete domain compromise
- Service account misuse: Domain admin accounts should never be used as service accounts
- Password exposure: SPNs enable offline password cracking attempts
Zero domain admin accounts should have SPNs configured.
Control Type
Section titled “Control Type”Preventive
Security Recommendation
Section titled “Security Recommendation”If domain admin accounts have SPNs:
- Immediate action: Remove all SPNs from domain admin accounts
- Investigate: Determine why SPNs were configured
- Migrate services: Move services to dedicated service accounts or gMSAs
- Audit: Review who has domain admin privileges
- Monitor: Implement alerts for SPN changes to privileged accounts
How the Test Works
Section titled “How the Test Works”This test identifies domain administrator accounts (using the well-known RID 500) and checks if they have any SPNs configured. Any SPNs found on these accounts are flagged as critical security risks.
Related Tests
Section titled “Related Tests”Test-MtAdUserSpnDomainAdminDetails- Detailed SPN information for domain adminsTest-MtAdUserSpnTotalCount- Overall user SPN countTest-MtAdUserSpnServiceClassCount- Service classes on user accounts
Related links
Section titled “Related links”- Microsoft Defender for Identity: Unsecure account attributes
- ANSSI Active Directory checkpoints: Privileged accounts with SPN
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-SPN-12 |
| Severity | Critical |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Service principal names |
| Area | Privileged access |
| Resource type | User |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1558.003 Kerberoasting |
| Supports controls | nist-800-53-r5:AC-6(5), nist-800-53-r5:IA-5 |
| PowerShell test | Test-MtAdUserSpnDomainAdminCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:domainDNS:ReadProperty, ActiveDirectory:Ldap:user:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/spn/Test.AD-SPN-12.ps1 - Documentation:
tests/ad/spn/Test.AD-SPN-12.md