# User SPN unknown service class details should be investigated

Detailed information about unknown user SPNs is critical for security:

Source: https://maester.dev/docs/tests/AD-SPN-10

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Service principal names · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-SPN-10
```

## Overview

Detailed information about unknown user SPNs is critical for security:

- **Immediate action required**: User SPNs are prime Kerberoasting targets
- **Accountability**: Know exactly which users have unknown SPNs
- **Investigation**: Track down service owners quickly
- **Risk assessment**: Determine if high-privilege users have unknown SPNs

Unknown SPNs on privileged user accounts represent the highest risk.

#### Control Type

**Operational**

#### Security Recommendation

For each unknown user SPN:
1. Contact the user or their manager to understand the service
2. Verify if the service is legitimate and necessary
3. If legitimate, document it and consider migrating to gMSA
4. If unauthorized, remove the SPN immediately
5. Check if the account has been compromised

#### How the Test Works

This test analyzes all user SPNs, identifies unknown service classes, and provides detailed information about which users have these SPNs.

#### Related Tests

- `Test-MtAdUserSpnUnknownCount` - Counts unknown service classes on users
- `Test-MtAdUserSpnDomainAdminDetails` - Checks domain admin SPNs specifically
- `Test-MtAdComputerSpnUnknownDetails` - Unknown computer SPN details

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-SPN-10 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Service principal names |
| Area | Authentication |
| Resource type | User |
| MITRE ATT&CK | T1558.003 Kerberoasting |
| PowerShell test | [Test-MtAdUserSpnUnknownDetails](https://github.com/maester365/maester/blob/main/tests/ad/spn/Test.AD-SPN-10.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:user:ReadProperty |

</details>

## Source

- Test: [`tests/ad/spn/Test.AD-SPN-10.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/spn/Test.AD-SPN-10.ps1)
- Documentation: [`tests/ad/spn/Test.AD-SPN-10.md`](https://github.com/maester365/maester/blob/main/tests/ad/spn/Test.AD-SPN-10.md)