Detent Point

SpnManager Kerberos SPN auditing and repair for Active Directory

Export-SpnAuditHandoff

The Export-SpnAuditHandoff command is used by administrators to facilitate the transfer of SPN management responsibilities between teams or roles. This bus...

The Export-SpnAuditHandoff command is used by administrators to facilitate the transfer of SPN management responsibilities between teams or roles. This business value is critical in large organizations with complex IT infrastructures.

  • Key stakeholders: AD administrators, security teams, and change management teams.
  • Risks:
    • Inaccurate handoffs can lead to security vulnerabilities.
    • Failure to follow procedures can result in data loss or corruption.
  • Managerial concerns:
    • Ensuring accurate and complete transfer of responsibilities.
    • Minimizing downtime and disruption during the transition.

To use Export-SpnAuditHandoff, follow these steps:

  1. Run Get-SpnAuditPlan to retrieve the audit plan for the current phase.
  2. Pipe the output to Export-SpnAuditHandoff to generate the handoff bundle:
Get-SpnAuditPlan | Export-SpnAuditHandoff

The command will produce a HandoffBundle containing setspn commands for missing and orphaned SPNs.

  • Common patterns: Use this command in combination with Get-SpnAuditPlan to automate the audit process.
  • Watchpoints:
    • Verify that the output is accurate before proceeding with the handoff.
    • Ensure that all stakeholders have access to the handoff bundle.

Export-SpnAuditHandoff renders a set of commands for transferring SPN management responsibilities. Here’s how it works:

  1. The command takes an audit plan as input and generates a HandoffBundle containing setspn commands.
  2. The output is a newline-delimited string that can be copied and pasted into a privileged session.
  • Simple recipe:
    • Run Get-SpnAuditPlan to retrieve the audit plan.
    • Pipe the output to Export-SpnAuditHandoff to generate the handoff bundle.
  • What to do when stuck: Consult the documentation or contact support for assistance with debugging.
Field Value
Vendor Detent Point LLC
Product SpnManager 0.4.0
Licence Proprietary - licensed, not sold. See LICENSE.
Operational impact Read-only. Queries Active Directory and reports findings; changes nothing.
Rights required Directory read access. Some providers additionally need rights to read delegation and encryption-type attributes.
Providers covered AD.RDP, AD.SMB, AD.WinRM, AD.DNS, AD.PrintSpooler, AD.Exchange, AD.ADCS, AD.DFS
Approval recommendation Approve for general operational use. It cannot alter directory state.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

What Why
Windows PowerShell 5.1 or later Declared by the module manifest.
ActiveDirectory 1.0.0.0 Required module. Ships with RSAT; install the Active Directory PowerShell feature.
A reachable domain controller Every provider reads from Active Directory.
An account with directory read access Needed to enumerate accounts and their SPNs.

Export-SpnAuditHandoff handles sensitive data, including SPN configurations and account information. To ensure compliance:

  • Data-handling: The command processes audit plan data without storing it or transmitting it over unencrypted channels.
  • Transit: No data is transmitted during the execution of this command.
  • At-rest: All data is stored securely in accordance with organizational policies.
  • Audit trail: Export-SpnAuditHandoff logs all activity, including input and output data.

This is the hand-off step. It renders the commands for a human to run; SpnManager does not run them. Providers: AD.ADCS, AD.DFS, AD.DNS, AD.Exchange, AD.PrintSpooler, AD.RDP, AD.SMB, AD.WinRM.

Example 1

$plan | Export-SpnAuditHandoff

Example 2

$result = Export-SpnAuditHandoff -Plan $plan
$result.HandoffBundle | Write-Host

Example 3

$plan | Export-SpnAuditHandoff