Kerberos breaks quietly. A service principal name goes missing, or gets registered against the wrong account, and authentication falls back to NTLM. Nothing errors. Things just get slower, or one application starts prompting for credentials it never used to ask for, and the cause is three changes back in a directory nobody wants to touch by hand.

SpnManager finds those problems and shows you the fix before it changes anything.

What it covers

Twenty-six providers across the estate: the SQL Server family, HTTP services like IIS, ADFS and SharePoint, machine-account SPNs, the delegation and encryption-type audits, and the non-Windows families — Oracle, SAP, Java SPNEGO, Linux hosts joined to the domain, and SSO appliances.

It reads before it writes

The work happens in stages, and only the last one changes anything:

Stage	What it does	Changes Active Directory?
Sense	Reads the current state	No
Plan	Works out what is missing	No
Test	Checks the plan before anything acts on it	No
Hand-off	Renders the commands for someone else to run	No
Execute	Registers or removes the SPNs	Yes

Of the whole command surface, four commands write to the directory. Everything else reads. That matters if the person who finds the problem is not the person allowed to fix it, which is the normal arrangement in most places — hand-off mode produces the setspn commands for an AD administrator to review and run, and touches nothing itself.

On a schedule

SPN drift is continuous, because every service account change and every rename is a chance to create it. Jobs can be scheduled for Task Scheduler, cron or SQL Server Agent. They run in audit mode by default: a scheduled job is created once and then runs unattended for years, frequently by someone other than whoever wrote it, so the mode that writes to Active Directory has to be asked for by name.

Where it is today

SpnManager is live. The documentation here is complete, so you can evaluate exactly what it does before deciding whether it belongs in your estate. To get it for your environment, get in touch.

SQL Server SPNs are already covered, free, by SqlSpnManager on the PowerShell Gallery — including registration, not just auditing. SpnManager is the rest of the directory: the other twenty-five service families, forest-wide sweeps, and the delegation and encryption-type audits. How the two relate long term is not settled, and the free edition’s scope may narrow toward auditing in a future release; any version you install stays yours, because the Gallery keeps published versions available.

Start with the adoption guide, which walks every phase of using it, or go straight to the command reference.