Detent PointBusiness value: The Export-SapSpnRunbook cmdlet helps managers identify SAP NetWeaver SPN gaps and generate a hand-off runbook to resolve the issue.
Who uses this: System administrators and security teams responsible for maintaining SAP systems and ensuring Kerberos authentication works correctly.
Risks: * Failed Kerberos authentication can lead to data breaches. * Incomplete or inaccurate runbooks can cause delays in resolving issues.
When a manager cares: * When there are multiple SAP systems with SPN gaps. * When there’s a large number of users affected by failed Kerberos authentication.
Day-to-day use:
- Run
Get-SapSpnAuditto identify SAP NetWeaver SPN gaps. - Pipe the output to
Export-SapSpnRunbookto generate a hand-off runbook. - Review and customize the generated runbook as needed.
Common patterns: * Running the cmdlet as part of regular maintenance tasks. * Using the generated runbook as input for other tools or processes.
Code example:
$audit = Get-SapSpnAudit
$result = $audit | Export-SapSpnRunbook
$resultWatchpoints: * Ensure the SAP system is properly configured and connected. * Verify that Kerberos authentication is enabled and working correctly.
What this does in simple terms: This cmdlet helps identify SAP NetWeaver SPN gaps and generates a runbook to resolve the issue, ensuring Kerberos authentication works correctly.
Step-by-step recipe:
- Run
Get-SapSpnAuditto find SAP NetWeaver SPN gaps. - Get the output of the previous step and pipe it to
Export-SapSpnRunbook. - Review and customize the generated runbook as needed.
What to do when stuck: * Consult the documentation for Get-SapSpnAudit and Export-SapSpnRunbook. * Reach out to a colleague or IT support team if unsure about how to proceed.
| Field | Value |
|---|---|
| Vendor | Detent Point LLC |
| Product | SpnManager 0.4.0 |
| Licence | Proprietary - licensed, not sold. See LICENSE. |
| Operational impact | Read-only. Queries Active Directory and reports findings; changes nothing. |
| Rights required | Directory read access. Some providers additionally need rights to read delegation and encryption-type attributes. |
| Providers covered | AD.SAP |
| Approval recommendation | Approve for general operational use. It cannot alter directory state. |
Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.
| What | Why |
|---|---|
| Windows PowerShell 5.1 or later | Declared by the module manifest. |
| ActiveDirectory 1.0.0.0 | Required module. Ships with RSAT; install the Active Directory PowerShell feature. |
| A reachable domain controller | Every provider reads from Active Directory. |
| An account with directory read access | Needed to enumerate accounts and their SPNs. |
Data handling: * The cmdlet only reads and processes existing data, without modifying or adding new information.
Transit: * Data is transmitted between tools and systems as required for Kerberos authentication.
At rest: * Data is stored in accordance with organizational security policies and compliance requirements.
Audit trail: * The cmdlet does not modify or delete any audit logs or records.
Compliance requirements: * Follow all applicable data protection, security, and auditing regulations.
This is the hand-off step. It renders the commands for a human to run; SpnManager does not run them. Providers: AD.SAP.
Example 1
Get-SapSpnAudit -TargetComputer 'sap01.corp.example.test' | Export-SapSpnRunbookAudits the SAP application server and renders the hand-off runbook.
Also uses: Get-SapSpnAudit (Sense).
Example 2
(Get-SapSpnAudit -TargetComputer 'sap01.corp.example.test' | Export-SapSpnRunbook).SetspnBundleThe AD-side commands alone, for the directory team.
Also uses: Get-SapSpnAudit (Sense).
Example 3
Get-SapSpnAudit -TargetComputer 'sap01.corp.example.test' |
Export-SapSpnRunbook |
Select-Object -ExpandProperty Runbook |
Set-Content 'sap-kerberos-change.txt'Writes the whole runbook to a file to attach to a change request.
Also uses: Get-SapSpnAudit (Sense).