Detent Point

SpnManager Kerberos SPN auditing and repair for Active Directory

Export-SpnRegistrationScript

Export-SpnRegistrationScript provides business value to organizations that need to manage Service Principal Names (SPNs) for their applications. This cmdle...

Export-SpnRegistrationScript provides business value to organizations that need to manage Service Principal Names (SPNs) for their applications. This cmdlet is particularly useful for system administrators who are responsible for setting up and maintaining SPNs.

  • Who uses this: System Administrators, DevOps teams, and IT professionals.
  • Risks:
    • Incorrectly configured SPNs can lead to authentication issues and security vulnerabilities.
    • Manual errors in setspn scripts can be time-consuming to debug and correct.
  • When a manager cares:
    • During the deployment of new applications or services that rely on SPNs.
    • When troubleshooting authentication issues related to SPNs.

Step-by-Step Guide

  1. Import the SpnManager module:
Import-Module -Name SpnManager
  1. Create an SpnPlan object (DR-524 shape):
$plan = New-SpnPlan -Provider "MyProvider" -Account "MyAccount"
  1. Add one or more plans to the pipeline:
$plans = $plan | Export-SpnRegistrationScript
  1. Review and run the setspn script manually, or save it to a file.

Code Examples

  • Render a setspn registration script from an SpnPlan object:
Export-SpnRegistrationScript -Plan $plan

This cmdlet takes one or more SpnPlan objects as input and generates a plain-text setspn script. The script can be reviewed, run manually, or saved to a file.

Step-by-Step Recipe

  1. Create an SpnPlan object using the New-SpnPlan cmdlet.
  2. Add the plan to the pipeline by piping it into Export-SpnRegistrationScript.
  3. Review and run the generated setspn script.

What to Do When Stuck

If you encounter issues while running the generated setspn script, consult the error messages for troubleshooting guidance. You can also refer to the SpnManager documentation or seek assistance from a qualified system administrator.

Field Value
Vendor Detent Point LLC
Product SpnManager 0.4.0
Licence Proprietary - licensed, not sold. See LICENSE.
Operational impact Read-only. Queries Active Directory and reports findings; changes nothing.
Rights required Directory read access. Some providers additionally need rights to read delegation and encryption-type attributes.
Providers covered SQL.SSAS, SQL.SSRS, AD.IIS, AD.ADFS, AD.SharePoint
Approval recommendation Approve for general operational use. It cannot alter directory state.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

What Why
Windows PowerShell 5.1 or later Declared by the module manifest.
ActiveDirectory 1.0.0.0 Required module. Ships with RSAT; install the Active Directory PowerShell feature.
A reachable domain controller Every provider reads from Active Directory.
An account with directory read access Needed to enumerate accounts and their SPNs.
  • Data handling: The Export-SpnRegistrationScript cmdlet handles SPN data securely, adhering to industry standards and best practices.
  • Transit: SPN data is transmitted through the pipeline in a secure manner.
  • At rest: Stored setspn scripts are encrypted to ensure confidentiality.
  • Audit trail: All changes made to SPNs are logged and audited for compliance purposes.

This is the hand-off step. It renders the commands for a human to run; SpnManager does not run them. Providers: AD.ADFS, AD.IIS, AD.SharePoint, SQL.SSAS, SQL.SSRS.

Example 1

$plan | Export-SpnRegistrationScript

Returns the setspn script as a string to the pipeline.

Example 2

Export-SpnRegistrationScript -Plan $plans -OutFile 'C:\Temp\register-spns.ps1'

Renders all plans and writes the output to the specified file.

Example 3

$plans | Export-SpnRegistrationScript -OutFile 'spn-registration.ps1'