Available today in SqlSpnManager

SQL Server is where this work started. Add-SqlSpn ships in SqlSpnManager, on the PowerShell Gallery now — Install-Module SqlSpnManager. You can run it today.

SPN Manager takes the same approach across the rest of the directory, 26 service families in all. How the two products relate long term is not settled, and the free edition’s scope may narrow toward auditing in a future release. Any version you install stays yours — the Gallery keeps published versions available.

Audience Lens Examples

Manager Practitioner Learner

The Add-SqlSpn cmdlet is a crucial tool for managing Service Principal Names (SPNs) in a SQL environment. It’s used by system administrators who need to configure SPNs for SQL Server instances. The business value of this cmdlet lies in its ability to streamline the process of registering SPNs, making it easier to manage complex environments.

Business Value: Efficient management of SPNs reduces administrative burden and improves system reliability.
Who uses this: System administrators responsible for configuring and managing SQL Server instances.
Risks: Incomplete or incorrect configuration of SPNs can lead to authentication issues and security vulnerabilities.

The Add-SqlSpn cmdlet is used in the following scenario:

Create a plan with ProposedSpns specified:

$plan = New-Plan -Name "MyPlan" -ProposedSpns @("SQLSvc/mydomain", "SQLSvc/myotherdomain")

Run Add-SqlSpn on the plan to register the SPNs:
```
Add-SqlSpn -SpnPlan $plan
```
The cmdlet will iterate over the ProposedSpns, call setspn -S, and write a SUCCESS entry to the audit log.

Common Patterns: Use this cmdlet in scripts that automate SPN configuration for SQL Server instances.
Code Examples:
```
Add-SqlSpn -SpnPlan $plan
```
Watchpoints:
- Ensure proper authentication and access control are configured before running the cmdlet.
- Monitor the audit log for SUCCESS entries to verify SPN registration.

The Add-SqlSpn cmdlet is used to register Service Principal Names (SPNs) for SQL Server instances. Here’s a simplified explanation of what it does:

What: Registers each SPN from a plan against the plan’s AccountDn.
Why: This ensures that SPNs are correctly configured for SQL Server authentication.
- Step-by-Step Recipe:
  1. Create a new plan with ProposedSpns specified
  2. Run Add-SqlSpn on the plan to register the SPNs

What to Do When Stuck:

Check the audit log for SUCCESS entries to verify SPN registration.
Verify that proper authentication and access control are configured.

Software Approval Dependencies Compliance

Field	Value
Vendor	Detent Point LLC
Product	SpnManager 0.4.0
Licence	Proprietary - licensed, not sold. See LICENSE.
Operational impact	CHANGES directory state. Registers or removes Service Principal Names on Active Directory accounts.
Rights required	Directory read access.
Providers covered	framework surface (not provider-specific)
Approval recommendation	Approve for use by directory administrators, through change control. Preview with -WhatIf before any scheduled use.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

What	Why
Windows PowerShell 5.1 or later	Declared by the module manifest.
ActiveDirectory 1.0.0.0	Required module. Ships with RSAT; install the Active Directory PowerShell feature.
A reachable domain controller	Every provider reads from Active Directory.
An account with directory read access	Needed to enumerate accounts and their SPNs.
Rights to write servicePrincipalName	Only for the write path. Audit and hand-off operations do not need it.

The Add-SqlSpn cmdlet handles data securely, with no sensitive information being transmitted or stored in clear text.

Data-in-Transit: None.
Data-at-Rest: The cmdlet uses setspn.exe to store SPN registrations on the system. Data is stored in a secure manner by the external tool.
Audit Trail: The cmdlet writes SUCCESS entries to the audit log, providing a clear record of SPN registration activity.

Compliance Requirements:

Follow standard security practices when using this cmdlet, ensuring proper authentication and access control are configured.
Monitor the audit log for successful SPN registrations.

This command changes Active Directory. Run it with -WhatIf first to see exactly which SPNs would be registered or removed.

Example 1

$plan = New-SqlSpnPlan -VerifiedAccount $acct -Infrastructure $infra -Role Engine
$plan | Add-SqlSpn -WhatIf

Also uses: New-SqlSpnPlan (Plan).

Example 2

New-SqlSpnPlan -VerifiedAccount $acct -Infrastructure $infra -Role Engine | Add-SqlSpn

Also uses: New-SqlSpnPlan (Plan).

Example 3

$spnPlan | Add-SqlSpn