Detent Point

SpnManager Kerberos SPN auditing and repair for Active Directory

Export-SqlSpnRegistrationScript

Business value: This command streamlines the SPN registration process by automating the generation of a setspn command bundle for AD admins to run, reducin...

Available today in SqlSpnManager

SQL Server is where this work started. Export-SqlSpnRegistrationScript ships in SqlSpnManager, on the PowerShell Gallery now — Install-Module SqlSpnManager. You can run it today.

SPN Manager takes the same approach across the rest of the directory, 26 service families in all. How the two products relate long term is not settled, and the free edition’s scope may narrow toward auditing in a future release. Any version you install stays yours — the Gallery keeps published versions available.

Business value: This command streamlines the SPN registration process by automating the generation of a setspn command bundle for AD admins to run, reducing errors and improving efficiency.

  • Key stakeholders: DBAs and AD admins who separate duties in regulated environments or with strict role separation.
  • Risks:
    • Inaccurate hand-crafted setspn commands leading to failed registrations.
    • AD admin round-trips causing delays and increased support requests.
  • Manager cares when:
    • There’s a high volume of SPN registrations requiring manual intervention.
    • Errors in hand-crafted setspn commands cause registration failures.

Day-to-day use:

  1. Use New-SqlSpnPlan to generate an SPN plan, then pipe it to this command.
  2. Specify the target account’s sAMAccountName and DistinguishedName using -TargetIdentity.
  3. Choose a file path for the output bundle using -Path.

Example code:

$plan = New-SqlSpnPlan -VerifiedAccount $acct -Infrastructure $infra -Role Engine
Export-SqlSpnRegistrationScript -Plan $plan -Path 'C:\Reports\spn-registration.ps1'

Watchpoints:

  • Ensure the target account has the necessary ACEs to register SPNs.
  • Verify the AD admin runs the generated bundle with the correct permissions.

What this does: This command takes an SPN plan as input and generates a clean setspn command bundle for AD admins to run. The bundle includes one setspn -S line per ProposedSpn in the plan, along with any required flags (e.g., -T for cross-forest plans).

Step-by-step recipe:

  1. Generate an SPN plan using New-SqlSpnPlan.
  2. Pipe the plan to this command.
  3. Specify the target account’s details as needed.

When stuck: Consult the module documentation, and if issues persist, contact support.

Field Value
Vendor Detent Point LLC
Product SpnManager 0.4.0
Licence Proprietary - licensed, not sold. See LICENSE.
Operational impact Read-only. Queries Active Directory and reports findings; changes nothing.
Rights required Directory read access. Some providers additionally need rights to read delegation and encryption-type attributes.
Providers covered SQL.Engine
Approval recommendation Approve for general operational use. It cannot alter directory state.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

What Why
Windows PowerShell 5.1 or later Declared by the module manifest.
ActiveDirectory 1.0.0.0 Required module. Ships with RSAT; install the Active Directory PowerShell feature.
A reachable domain controller Every provider reads from Active Directory.
An account with directory read access Needed to enumerate accounts and their SPNs.

Data handling: The command only generates a setspn command bundle, which does not store or transmit sensitive data.

Data transit: The bundle is written to a file or returned as a string array; no network transmission occurs during execution.

Data at rest: The generated bundle can be stored securely on the system.

Audit trail: The bundle’s header includes provenance information (SpnManager module version, plan PlanGuid, UTC generation stamp, and target account details), which can be used to track changes and executions.

Compliance requirements:

  • This command does not handle sensitive data, but ensure that setspn.exe usage complies with local AD policies.

This is the hand-off step. It renders the commands for a human to run; SpnManager does not run them. Providers: SQL.Engine.

Example 1

$plan = New-SqlSpnPlan -VerifiedAccount $acct -Infrastructure $infra -Role Engine
$plan | Export-SqlSpnRegistrationScript -Path '.\register-svc_sql_prod.cmd'

Also uses: New-SqlSpnPlan (Plan).

Example 2

New-SqlSpnPlan -VerifiedAccount $acct -Infrastructure $infra -Role Engine |
    Export-SqlSpnRegistrationScript -Format PowerShell |
    Set-Clipboard

Also uses: New-SqlSpnPlan (Plan).

Example 3

$plan | Export-SqlSpnRegistrationScript -Format $format -Path 'spn-registration.txt'