# No domain admin accounts should have SPNs configured

Detailed visibility into domain admin SPNs is critical for security incident response:

Source: https://maester.dev/docs/tests/AD-SPN-13

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Service principal names · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-SPN-13
```

## Overview

Detailed visibility into domain admin SPNs is critical for security incident response:

- **Immediate remediation**: Know exactly which SPNs to remove
- **Service identification**: Understand what services were improperly configured
- **Attack surface assessment**: Evaluate the scope of exposure
- **Compliance violation**: Domain admins should never have SPNs

Any SPN on a domain admin account is a critical finding requiring immediate action.

#### Control Type

**Preventive**

#### Security Recommendation

**Immediate actions required:**
1. Remove ALL SPNs from domain administrator accounts
2. Investigate how and why SPNs were configured
3. Create dedicated service accounts or gMSAs for the services
4. Review domain admin membership and remove unnecessary accounts
5. Implement monitoring for SPN changes to privileged accounts
6. Consider this a potential security incident requiring investigation

#### How the Test Works

This test identifies domain administrator accounts and provides detailed information about any SPNs configured on them, including service class, host, FQDN status, and full SPN value for remediation.

#### Related Tests

- `Test-MtAdUserSpnDomainAdminCount` - Counts SPNs on domain admins
- `Test-MtAdUserSpnTotalCount` - Overall user SPN analysis
- `Test-MtAdUserSpnUnknownDetails` - Unknown SPN details on all users

#### Related links

- [Microsoft Defender for Identity: Unsecure account attributes](https://learn.microsoft.com/defender-for-identity/security-posture-assessments/accounts#unsecure-account-attributes)
- [ANSSI Active Directory checkpoints: Privileged accounts with SPN](https://www.cert.ssi.gouv.fr/uploads/ad_checklist.html#vuln_spn_priv)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-SPN-13 |
| Severity | Critical |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Service principal names |
| Area | Privileged access |
| Resource type | User |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1558.003 Kerberoasting |
| Supports controls | nist-800-53-r5:AC-6(5), nist-800-53-r5:IA-5 |
| PowerShell test | [Test-MtAdUserSpnDomainAdminDetails](https://github.com/maester365/maester/blob/main/tests/ad/spn/Test.AD-SPN-13.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:domainDNS:ReadProperty, ActiveDirectory:Ldap:user:ReadProperty |

</details>

## Source

- Test: [`tests/ad/spn/Test.AD-SPN-13.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/spn/Test.AD-SPN-13.ps1)
- Documentation: [`tests/ad/spn/Test.AD-SPN-13.md`](https://github.com/maester365/maester/blob/main/tests/ad/spn/Test.AD-SPN-13.md)