# No domain admin accounts should have SPNs configured

Domain administrator accounts with SPNs represent the highest possible Kerberoasting risk:

Source: https://maester.dev/docs/tests/AD-SPN-12

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Service principal names · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-SPN-12
```

## Overview

Domain administrator accounts with SPNs represent the **highest possible Kerberoasting risk**:

- **Maximum privileges**: Domain admins have unrestricted access to the entire domain
- **Golden ticket risk**: Compromising a domain admin can lead to complete domain compromise
- **Service account misuse**: Domain admin accounts should never be used as service accounts
- **Password exposure**: SPNs enable offline password cracking attempts

**Zero domain admin accounts should have SPNs configured.**

#### Control Type

**Preventive**

#### Security Recommendation

If domain admin accounts have SPNs:
- **Immediate action**: Remove all SPNs from domain admin accounts
- **Investigate**: Determine why SPNs were configured
- **Migrate services**: Move services to dedicated service accounts or gMSAs
- **Audit**: Review who has domain admin privileges
- **Monitor**: Implement alerts for SPN changes to privileged accounts

#### How the Test Works

This test identifies domain administrator accounts (using the well-known RID 500) and checks if they have any SPNs configured. Any SPNs found on these accounts are flagged as critical security risks.

#### Related Tests

- `Test-MtAdUserSpnDomainAdminDetails` - Detailed SPN information for domain admins
- `Test-MtAdUserSpnTotalCount` - Overall user SPN count
- `Test-MtAdUserSpnServiceClassCount` - Service classes on user accounts

#### Related links

- [Microsoft Defender for Identity: Unsecure account attributes](https://learn.microsoft.com/defender-for-identity/security-posture-assessments/accounts#unsecure-account-attributes)
- [ANSSI Active Directory checkpoints: Privileged accounts with SPN](https://www.cert.ssi.gouv.fr/uploads/ad_checklist.html#vuln_spn_priv)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-SPN-12 |
| Severity | Critical |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Service principal names |
| Area | Privileged access |
| Resource type | User |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1558.003 Kerberoasting |
| Supports controls | nist-800-53-r5:AC-6(5), nist-800-53-r5:IA-5 |
| PowerShell test | [Test-MtAdUserSpnDomainAdminCount](https://github.com/maester365/maester/blob/main/tests/ad/spn/Test.AD-SPN-12.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:domainDNS:ReadProperty, ActiveDirectory:Ldap:user:ReadProperty |

</details>

## Source

- Test: [`tests/ad/spn/Test.AD-SPN-12.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/spn/Test.AD-SPN-12.ps1)
- Documentation: [`tests/ad/spn/Test.AD-SPN-12.md`](https://github.com/maester365/maester/blob/main/tests/ad/spn/Test.AD-SPN-12.md)