Detent Point

SpnManager Kerberos SPN auditing and repair for Active Directory

Assert-SqlAccountStandard

Active Directory account validation is crucial for ensuring compliance with organizational policies and standards. The Assert-SqlAccountStandard cmdlet fro...

Available today in SqlSpnManager

SQL Server is where this work started. Assert-SqlAccountStandard ships in SqlSpnManager, on the PowerShell Gallery now — Install-Module SqlSpnManager. You can run it today.

SPN Manager takes the same approach across the rest of the directory, 26 service families in all. How the two products relate long term is not settled, and the free edition’s scope may narrow toward auditing in a future release. Any version you install stays yours — the Gallery keeps published versions available.

Active Directory account validation is crucial for ensuring compliance with organizational policies and standards. The Assert-SqlAccountStandard cmdlet from the SpnManager module is used to validate an Active Directory account against a named compliance policy.

  • Who uses this: IT administrators, security teams, and database administrators.
  • Risks:
    • Non-compliance with organizational policies can lead to data breaches and security incidents.
    • Invalid or non-existent accounts can disrupt database services and impact business operations.
  • When a manager cares:
    • During initial setup of new Active Directory accounts for SQL Server instances.
    • After changes are made to compliance policies or account configurations.

Day-to-day use

  1. Validate an account against a policy:
Assert-SqlAccountStandard -PolicyName "SQLServerPolicy" -SamAccountName "myaccount"
  1. Use with Start-SqlSpnConfiguration:
Start-SqlSpnConfiguration -SamAccountName 'svc_sql_prod' -Role Engine -TargetName 'sqlsrv01'

Common patterns

  • Use the cmdlet as a pre-flight check before configuring SQL Server instances.
  • Validate accounts against multiple policies using the -PolicyName parameter.

Watchpoints

  • Make sure to specify the correct policy name and account names.
  • Be aware of the compliance requirements for your organization.

What this does in simple terms

The Assert-SqlAccountStandard cmdlet checks if an Active Directory account meets the requirements set by a named compliance policy. It ensures that the account’s object class, SamAccountName, and distinguished name match the policy’s settings.

Step-by-step recipe

  1. Identify the compliance policy to be used (e.g., “SQLServerPolicy”).
  2. Specify the Active Directory account to be validated.
  3. Call the cmdlet with the policy name and account name as parameters.

What to do when stuck

  • Check the policy requirements against your organization’s standards.
  • Verify that the account exists in Active Directory and has correct settings.
  • Consult the SpnManager module documentation or seek help from IT administrators.
Field Value
Vendor Detent Point LLC
Product SpnManager 0.4.0
Licence Proprietary - licensed, not sold. See LICENSE.
Operational impact Read-only. Queries Active Directory and reports findings; changes nothing.
Rights required Directory read access.
Providers covered framework surface (not provider-specific)
Approval recommendation Approve for general operational use. It cannot alter directory state.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

What Why
Windows PowerShell 5.1 or later Declared by the module manifest.
ActiveDirectory 1.0.0.0 Required module. Ships with RSAT; install the Active Directory PowerShell feature.
A reachable domain controller Every provider reads from Active Directory.
An account with directory read access Needed to enumerate accounts and their SPNs.
  • Data handling: The cmdlet retrieves account information from Active Directory.
  • Transit: No sensitive data is transmitted during execution.
  • At rest: Account information is stored in memory temporarily.
  • Audit trail: Log entries are generated for successful and failed validations.
  • Compliance requirements:
    • Ensure compliance with organization-specific policies and standards.
    • Validate accounts regularly to maintain compliance.

Example 1

Assert-SqlAccountStandard -SamAccountName svc_sql_prod -PolicyName Std_Engine

Example 2

# FCI Engine resolves to Std_Engine - a domain service account, never the
# cluster computer object (DR-558; policy reconciled in D-2 / DR-585).
# Resolve-SqlPolicyFromContext is a PRIVATE helper and is not available to
# callers, so name the policy directly rather than resolving it.
Assert-SqlAccountStandard -SamAccountName 'svc_sql_fci' -PolicyName 'Std_Engine'

Example 3

Assert-SqlAccountStandard -SamAccountName 'svc_sql' -PolicyName $policyName