Detent Point

SpnManager Kerberos SPN auditing and repair for Active Directory

Export-ApplianceSsoSpnRunbook

The Export-ApplianceSsoSpnRunbook command is used by security teams to automate the process of resolving Service Principal Name (SPN) gaps for appliance SS...

The Export-ApplianceSsoSpnRunbook command is used by security teams to automate the process of resolving Service Principal Name (SPN) gaps for appliance SSO virtual-services. This command helps ensure that SPNs are correctly registered in Active Directory, allowing appliances to authenticate with clients.

  • Uses:
    • Security teams responsible for resolving SPN gaps
    • Organizations using appliance SSO virtual-services
  • Risks:
    • Incorrect registration of SPNs can lead to authentication issues between appliances and clients
    • Non-compliance with security policies and regulations regarding SPN management
  • When a manager cares:
    • During incident response or troubleshooting efforts related to appliance SSO authentication issues
    • When reviewing security compliance reports and identifying areas for improvement

To use the Export-ApplianceSsoSpnRunbook command, follow these steps:

  1. Run Get-ApplianceSsoSpnAudit to retrieve a list of findings.
  2. Select the finding related to the appliance SSO virtual-service SPN gap you want to resolve.
  3. Run Export-ApplianceSsoSpnRunbook -Finding <finding> to generate the AD-side setspn bundle and appliance-side keytab work.

Example code:

Get-ApplianceSsoSpnAudit | Where-Object { $_.Type -eq "SPN_Gap" } | Export-ApplianceSsoSpnRunbook

Watchpoints:

  • Ensure that the finding selected is related to the correct appliance SSO virtual-service SPN gap.
  • Review the generated setspn bundle and keytab work for accuracy before applying changes.

The Export-ApplianceSsoSpnRunbook command helps automate the process of resolving Service Principal Name (SPN) gaps for appliance SSO virtual-services. To use this command, follow these simple steps:

  1. Run Get-ApplianceSsoSpnAudit to retrieve a list of findings.
  2. Select the finding related to the appliance SSO virtual-service SPN gap you want to resolve.
  3. Run the Export-ApplianceSsoSpnRunbook command with the selected finding.

Recipe: * Run the command: Export-ApplianceSsoSpnRunbook -Finding <finding> * Review the generated setspn bundle and keytab work for accuracy

If stuck, check:

  • That the finding selected is related to the correct appliance SSO virtual-service SPN gap
  • That the generated setspn bundle and keytab work are accurate before applying changes
Field Value
Vendor Detent Point LLC
Product SpnManager 0.4.0
Licence Proprietary - licensed, not sold. See LICENSE.
Operational impact Read-only. Queries Active Directory and reports findings; changes nothing.
Rights required Directory read access. Some providers additionally need rights to read delegation and encryption-type attributes.
Providers covered AD.ApplianceSso
Approval recommendation Approve for general operational use. It cannot alter directory state.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

What Why
Windows PowerShell 5.1 or later Declared by the module manifest.
ActiveDirectory 1.0.0.0 Required module. Ships with RSAT; install the Active Directory PowerShell feature.
A reachable domain controller Every provider reads from Active Directory.
An account with directory read access Needed to enumerate accounts and their SPNs.

Data handling:

  • The command only generates setspn bundle and keytab work, no sensitive data is transmitted or stored.
  • Data at rest: The generated setspn bundle and keytab work are stored locally on the system.

Transit:

  • No sensitive data is transmitted during execution of the command.

Audit trail:

  • The command logs its actions in the PowerShell console and event logs.

Compliance requirements:

  • Must be used in accordance with organizational security policies and regulations regarding SPN management.

This is the hand-off step. It renders the commands for a human to run; SpnManager does not run them. Providers: AD.ApplianceSso.

Example 1

Get-ApplianceSsoSpnAudit -TargetComputer 'vip-portal.corp.example.test' | Export-ApplianceSsoSpnRunbook

Audits the appliance virtual service and renders the hand-off runbook.

Also uses: Get-ApplianceSsoSpnAudit (Sense).

Example 2

(Get-ApplianceSsoSpnAudit -TargetComputer 'vip-portal.corp.example.test' | Export-ApplianceSsoSpnRunbook).SetspnBundle

The AD-side commands alone, which is usually all the directory team needs - the appliance half is done by whoever administers the appliance.

Also uses: Get-ApplianceSsoSpnAudit (Sense).

Example 3

Get-ApplianceSsoSpnAudit -TargetComputer 'vip-portal.corp.example.test' |
    Export-ApplianceSsoSpnRunbook |
    Select-Object TargetAccount, MissingSpns

A compact view for triage across several virtual services.

Also uses: Get-ApplianceSsoSpnAudit (Sense).