Detent Point

SpnManager Kerberos SPN auditing and repair for Active Directory

Get-AdcsSpnCandidate

As a manager, you may be interested in the following aspects of Get-AdcsSpnCandidate:

As a manager, you may be interested in the following aspects of Get-AdcsSpnCandidate:

  • Business value: This cmdlet is used to build the expected RPCSS and HTTP SPN set for an AD Certificate Services server, which is critical for Kerberos-authenticated communication.
  • Who uses this: System administrators responsible for AD CS servers and certificate enrollment services.
  • Risks:
    • Incorrectly configured SPNs can lead to authentication issues and compromised security.
    • Failure to detect CES/CEP web services can result in incomplete or incorrect SPN configuration.
  • When a manager cares:
    • During the deployment of new AD CS servers or certificate enrollment services.
    • After changes are made to IIS site bindings or server configurations.

To use Get-AdcsSpnCandidate, follow these steps:

  1. Import the SpnManager module: Import-Module -Name SpnManager
  2. Run the cmdlet with a single parameter (optional): Get-AdcsSpnCandidate [-Bindings <Hashtable>]

Example code block:

$bindings = @{}
$bindings.Add("http", "Default Web Site")
Get-AdcsSpnCandidate -Bindings $bindings

Watchpoints:

  • Ensure the IIS assembly is loaded correctly to detect CES/CEP web services.
  • Verify that the -Bindings parameter is used correctly when testing with unit test data.

In simple terms, Get-AdcsSpnCandidate builds the expected SPN set for an AD Certificate Services server by:

  1. Auto-registering RPCSS/ (verified but not re-registered)
  2. Detecting and registering HTTP/ for CES/CEP web services

If you’re stuck, try:

  • Checking IIS site bindings and verifying the -Bindings parameter is used correctly.
  • Running with elevated permissions to ensure access to AD CS server configurations.
Field Value
Vendor Detent Point LLC
Product SpnManager 0.4.0
Licence Proprietary - licensed, not sold. See LICENSE.
Operational impact Read-only. Queries Active Directory and reports findings; changes nothing.
Rights required Directory read access. Some providers additionally need rights to read delegation and encryption-type attributes.
Providers covered AD.ADCS
Approval recommendation Approve for general operational use. It cannot alter directory state.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

What Why
Windows PowerShell 5.1 or later Declared by the module manifest.
ActiveDirectory 1.0.0.0 Required module. Ships with RSAT; install the Active Directory PowerShell feature.
A reachable domain controller Every provider reads from Active Directory.
An account with directory read access Needed to enumerate accounts and their SPNs.

This cmdlet handles SPNs securely by:

  • Auto-registering RPCSS/ and verifying its presence
  • Detecting HTTP/ for CES/CEP web services using IIS assembly
  • Providing a clear audit trail of detected web services and generated SPNs

Compliance requirements are met as follows: * Data in transit: Encrypted via SSL/TLS (HTTPS) when accessing AD CS server configurations. * Data at rest: Stored securely on the local system, adhering to organization’s data storage policies.

This is the sense step. It reads the current state and produces a candidate; nothing is changed. Its output is normally piped into New-AdcsSpnAuditPlan. Providers: AD.ADCS.

Example 1

Get-AdcsSpnCandidate -TargetComputer 'ca01.corp.example.com'

Inspects IIS bindings on ca01 for CES/CEP virtual paths.

Example 2

$b = @([PSCustomObject]@{HostHeader='ca01.corp.example.com'; AppPath='/CES'})
Get-AdcsSpnCandidate -Bindings $b

Uses injected binding data — no IIS assembly required.

Example 3

Get-AdcsSpnCandidate -TargetComputer 'web01' | New-AdcsSpnPlan