No domain admin accounts should have SPNs configured
AD-SPN-13CriticalActive DirectoryService principal names
Part of Active Directory · Active Directory · Service principal names · All checks
Invoke-Maester -TestId AD-SPN-13Overview
Section titled “Overview”Detailed visibility into domain admin SPNs is critical for security incident response:
- Immediate remediation: Know exactly which SPNs to remove
- Service identification: Understand what services were improperly configured
- Attack surface assessment: Evaluate the scope of exposure
- Compliance violation: Domain admins should never have SPNs
Any SPN on a domain admin account is a critical finding requiring immediate action.
Control Type
Section titled “Control Type”Preventive
Security Recommendation
Section titled “Security Recommendation”Immediate actions required:
- Remove ALL SPNs from domain administrator accounts
- Investigate how and why SPNs were configured
- Create dedicated service accounts or gMSAs for the services
- Review domain admin membership and remove unnecessary accounts
- Implement monitoring for SPN changes to privileged accounts
- Consider this a potential security incident requiring investigation
How the Test Works
Section titled “How the Test Works”This test identifies domain administrator accounts and provides detailed information about any SPNs configured on them, including service class, host, FQDN status, and full SPN value for remediation.
Related Tests
Section titled “Related Tests”Test-MtAdUserSpnDomainAdminCount- Counts SPNs on domain adminsTest-MtAdUserSpnTotalCount- Overall user SPN analysisTest-MtAdUserSpnUnknownDetails- Unknown SPN details on all users
Related links
Section titled “Related links”- Microsoft Defender for Identity: Unsecure account attributes
- ANSSI Active Directory checkpoints: Privileged accounts with SPN
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-SPN-13 |
| Severity | Critical |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Service principal names |
| Area | Privileged access |
| Resource type | User |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1558.003 Kerberoasting |
| Supports controls | nist-800-53-r5:AC-6(5), nist-800-53-r5:IA-5 |
| PowerShell test | Test-MtAdUserSpnDomainAdminDetails |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:domainDNS:ReadProperty, ActiveDirectory:Ldap:user:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/spn/Test.AD-SPN-13.ps1 - Documentation:
tests/ad/spn/Test.AD-SPN-13.md