User SPN count should be retrievable
AD-USER-14InfoActive DirectoryService principal names
Part of Active Directory · Active Directory · Service principal names · All checks
Invoke-Maester -TestId AD-USER-14Overview
Section titled “Overview”User accounts with ServicePrincipalName values are typically used as service accounts. These accounts are important because they may be susceptible to Kerberoasting and often have broad or persistent access.
- Kerberoasting exposure: User SPNs are a common attack target
- Service account discovery: Helps inventory service identities in the domain
- Hardening priority: Supports review of password hygiene, delegation, and logon restrictions
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Review every user account with an SPN and confirm it is a legitimate service account
- Prefer managed service account options where possible
- Ensure service accounts use strong credential and monitoring controls
How the Test Works
Section titled “How the Test Works”This test counts user objects where the ServicePrincipalName attribute contains one or more values.
Related Tests
Section titled “Related Tests”Test-MtAdUserKnownServiceAccountCount- Identifies service accounts by naming conventionTest-MtAdUserAdminCountCount- Highlights protected user accounts that may need extra scrutiny
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-USER-14 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Service principal names |
| Area | Authentication |
| Resource type | User |
| MITRE ATT&CK | T1558.003 Kerberoasting |
| PowerShell test | Test-MtAdUserSpnSetCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:user:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/user/Test.AD-USER-14.ps1 - Documentation:
tests/ad/user/Test.AD-USER-14.md