Export-KeytabDriftRunbook

Export-KeytabDriftRunbook is used by administrators to create a runbook for confirming and resolving POSSIBLE-keytab-skew findings reported by Get-KeytabDriftAudit. The runbook includes steps for the host owner or AD admin to confirm the skew on the host, regenerate and redistribute the keytab if necessary.

• Manager care factors:
  • Business value: Ensures keytab drift is identified and corrected in a timely manner.
  • Who uses this: Host owners, AD admins, administrators who manage SpnManager deployments.
  • Risks: Unresolved keytab drift can lead to authentication failures or security breaches.
  • When a manager cares:
    • During keytab drift audits to identify potential issues.
    • When host owners or AD admins report difficulties in resolving skew.

To use Export-KeytabDriftRunbook, follow these steps:

1. Run Export-KeytabDriftRunbook -Finding <findingId> and save the output as a runbook file.
2. Review the runbook contents to understand the necessary steps for host owner or AD admin confirmation.
3. Deploy the runbook on the affected host using standard deployment mechanisms (e.g., Ansible, SCCM).
4. Run the Execute-Script command in the runbook to execute the script that confirms skew and regenerates/distributes the keytab if necessary.

# Example usage:
Export-KeytabDriftRunbook -Finding "Audit.KeytabDrift.Finding1"

Watchpoints:

• Ensure the host owner or AD admin reviews the runbook contents carefully.
• Deploy the runbook using secure and approved mechanisms to prevent unauthorized access.

In simple terms, Export-KeytabDriftRunbook generates a runbook for confirming and resolving POSSIBLE-keytab-skew findings. Follow these steps:

1. Run the Export-KeytabDriftRunbook command with the finding ID.
2. Review the runbook contents to understand what needs to be done on the host.
3. Deploy the runbook on the affected host using standard deployment mechanisms.

When stuck:

• Consult the SpnManager documentation for more information on using Export-KeytabDriftRunbook.
• Contact your administrator or AD team if you need assistance with deploying or executing the runbook.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

Export-KeytabDriftRunbook does not directly handle or transmit sensitive information (keytab material). However, it includes placeholders for account passwords used by ktpass.

• Data handling:
  • The runbook is text-only, with no direct access to sensitive data.
  • Host owners or AD admins execute the scripts on the host using their own credentials.
• Transit and at-rest compliance: None, as no sensitive data is transmitted or stored directly by Export-KeytabDriftRunbook.
• Audit trail:
  • Log execution of the runbook commands for auditing purposes.
  • Review the script logs to track keytab regeneration and distribution events.

Confirming output:

The output contains all six headings in this order: Manager, Practitioner, Learner, Software Approval, Dependencies, Compliance.