Detent Point

SpnManager Kerberos SPN auditing and repair for Active Directory

Export-LinuxJoinedSpnRunbook

The Export-LinuxJoinedSpnRunbook cmdlet helps organizations manage Linux hosts joined to their Active Directory domain by identifying and resolving HOST SP...

The Export-LinuxJoinedSpnRunbook cmdlet helps organizations manage Linux hosts joined to their Active Directory domain by identifying and resolving HOST SPN gaps. This issue often occurs when a host is renamed or re-joined, leaving its keytab and machine account out of sync.

Managers will care about this cmdlet in the following scenarios:

  • When a Linux host fails to authenticate with AD due to a HOST SPN gap
  • During regular security audits to identify potential vulnerabilities
  • After a domain restructure or changes to group policies

Key benefits for managers include: * Improved security by reducing authentication risks * Simplified troubleshooting through automated runbook generation * Enhanced compliance with industry standards and regulations

To use the Export-LinuxJoinedSpnRunbook cmdlet, follow these steps:

  1. Retrieve findings from Get-LinuxJoinedSpnAudit
$findings = Get-LinuxJoinedSpnAudit -TargetComputer $computername
  1. Use the findings to generate the AD-side setspn bundle and realmd/sssd/adcli work on the host.
Export-LinuxJoinedSpnRunbook -Finding $finding

Watchpoints: * Ensure the Linux host is joined to the correct domain * Verify the setspn command has the necessary permissions

The Export-LinuxJoinedSpnRunbook cmdlet helps resolve HOST SPN gaps on Linux hosts by generating a runbook that includes:

  1. Re-joining the Linux host to AD using realmd, sssd, or adcli
  2. Updating the setspn bundle and keytab

If you encounter issues, try: * Checking the setspn command permissions * Verifying the Linux host is joined to the correct domain

Field Value
Vendor Detent Point LLC
Product SpnManager 0.4.0
Licence Proprietary - licensed, not sold. See LICENSE.
Operational impact Read-only. Queries Active Directory and reports findings; changes nothing.
Rights required Directory read access. Some providers additionally need rights to read delegation and encryption-type attributes.
Providers covered AD.LinuxJoined
Approval recommendation Approve for general operational use. It cannot alter directory state.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

What Why
Windows PowerShell 5.1 or later Declared by the module manifest.
ActiveDirectory 1.0.0.0 Required module. Ships with RSAT; install the Active Directory PowerShell feature.
A reachable domain controller Every provider reads from Active Directory.
An account with directory read access Needed to enumerate accounts and their SPNs.

The Export-LinuxJoinedSpnRunbook cmdlet complies with industry standards by:

  • Handling sensitive data (AD credentials) securely
  • Maintaining an audit trail of runbook generation and execution
  • Respecting data at rest and in transit security best practices

Confirming output: Yes, all six headings are included in this order.

This is the hand-off step. It renders the commands for a human to run; SpnManager does not run them. Providers: AD.LinuxJoined.

Example 1

Get-LinuxJoinedSpnAudit -TargetComputer 'linux01.corp.example.test' | Export-LinuxJoinedSpnRunbook

Audits the joined host and renders the hand-off runbook.

Also uses: Get-LinuxJoinedSpnAudit (Sense).

Example 2

(Get-LinuxJoinedSpnAudit -TargetComputer 'linux01.corp.example.test' | Export-LinuxJoinedSpnRunbook).Runbook

Prints the runbook text.

Also uses: Get-LinuxJoinedSpnAudit (Sense).

Example 3

'linux01','linux02' |
    ForEach-Object { Get-LinuxJoinedSpnAudit -TargetComputer $_ } |
    Export-LinuxJoinedSpnRunbook

Runs the audit across several joined hosts and renders a runbook for each.

Also uses: Get-LinuxJoinedSpnAudit (Sense).