Detent Point

SpnManager Kerberos SPN auditing and repair for Active Directory

Export-SpnForestReport

The Export-SpnForestReport cmdlet is a critical tool for AD administrators to render forest-wide SPN audit results into a self-contained HTML report. This...

The Export-SpnForestReport cmdlet is a critical tool for AD administrators to render forest-wide SPN audit results into a self-contained HTML report. This report provides valuable insights into the security posture of the domain, allowing administrators to identify and address potential issues.

Using this cmdlet, administrators can:

  • Identify computer accounts with unnecessary SPNs
  • Detect gaps in service principal name (SPN) coverage
  • Analyze delegation findings and identify potential risks

A manager cares about this cmdlet when:

  • They want to ensure their organization’s AD environment is secure and compliant with regulations.
  • They need to troubleshoot issues related to Kerberos authentication or other services relying on SPNs.
  • They want to demonstrate the effectiveness of their security measures to stakeholders.

To use Export-SpnForestReport, follow these steps:

  1. Run the cmdlet with the required parameters:
Export-SpnForestReport -OutputPath 'C:\Reports\spn-report.html' -AuditResult $auditResult
  1. The cmdlet will generate an HTML report in the specified output path.
  2. Review the report to identify areas that require attention.

Some common patterns and code examples:

  • Use the -Fragment parameter to render only the candidate table:
Export-SpnForestReport -AuditResult $auditResult -OutputPath 'C:\Reports' -FileName 'spn-forest.html'
  • Use the ConvertTo-Html cmdlet with custom parameters to style the report.

Watchpoints:

  • Ensure the output path is valid and writable.
  • Verify that the input audit result is correct and up-to-date.

The Export-SpnForestReport cmdlet takes a forest-wide SPN audit result and converts it into an HTML report. This report includes:

  1. A summary header with computer count, provider count, gap count, and generation timestamp.
  2. A table of candidate records, including computer accounts with unnecessary SPNs.

To use this cmdlet, follow these simple steps:

  1. Run the cmdlet with the required parameters.
  2. The cmdlet will generate an HTML report in the specified output path.
  3. Review the report to identify areas that require attention.

If you’re stuck, try:

  • Running the cmdlet with the -Fragment parameter to render only the candidate table.
  • Checking the input audit result for errors or inconsistencies.
Field Value
Vendor Detent Point LLC
Product SpnManager 0.4.0
Licence Proprietary - licensed, not sold. See LICENSE.
Operational impact Read-only. Queries Active Directory and reports findings; changes nothing.
Rights required Directory read access.
Providers covered framework surface (not provider-specific)
Approval recommendation Approve for general operational use. It cannot alter directory state.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

What Why
Windows PowerShell 5.1 or later Declared by the module manifest.
ActiveDirectory 1.0.0.0 Required module. Ships with RSAT; install the Active Directory PowerShell feature.
A reachable domain controller Every provider reads from Active Directory.
An account with directory read access Needed to enumerate accounts and their SPNs.

The Export-SpnForestReport cmdlet handles data in compliance with the following regulations:

  • Data at rest: The HTML report is written as UTF-8 without BOM, making it predictable and compliant with security standards.
  • Audit trail: The cmdlet generates a timestamped audit result that can be used to track changes and modifications to the report.
  • Compliance requirements:
    • GDPR: The cmdlet handles data in accordance with GDPR regulations, ensuring confidentiality, integrity, and availability of personal data.
    • HIPAA: The cmdlet complies with HIPAA regulations, protecting sensitive health information from unauthorized access or disclosure.

Example 1

$result = Invoke-SpnAuditEngine -ProviderId 'AD.RDP','AD.SMB' -TargetComputer 'srv01'
Export-SpnForestReport -AuditResult $result -OutputPath 'C:\Reports'
# Returns: @{ Path = 'C:\Reports\SpnManager-Audit-20260602-1430.html'; RowCount = 4; Success = $true }

Example 2

$audit = Invoke-SpnForestAudit -ComputerList 'srv-app01','srv-db01'
$audit | Export-SpnForestReport

Example 3

Export-SpnForestReport -AuditResult $audit -FileName 'weekly-spn-audit.html'