Detent PointThe Get-AdfsSpnCandidate cmdlet is used to build the expected HTTP SPN set for an ADFS federation service. This cmdlet provides business value by ensuring that Kerberos authentication works correctly with the federation endpoint.
- Used by: ADFS administrators, security teams, and anyone responsible for managing federation services.
- Risks:
- Incorrectly configured SPNs can lead to authentication failures and security issues.
- Failure to properly generate SPNs can result in downtime or data breaches.
- When a manager cares:
- During rollouts of new ADFS servers or service account changes.
- After major configuration updates or security incidents.
To use the Get-AdfsSpnCandidate cmdlet, follow these steps:
- Run the cmdlet in an interactive PowerShell session to prompt for federation service name and service account information.
Get-AdfsSpnCandidate -FederationServiceName "MyADFSService" -TargetComputer "MyADFSAccount"- Use the
-FederationServiceNameparameter to override the automatic detection of the federation service name. - If running in an automated environment and the ADFS module is not available, the cmdlet will return nothing.
Watchpoints:
- Ensure that the federation service name and service account are correctly configured.
- Verify that Kerberos authentication works as expected after generating SPNs.
The Get-AdfsSpnCandidate cmdlet builds a single HTTP/FQDN SPN for the ADFS federation endpoint. To use this cmdlet, follow these steps:
- Run the cmdlet in an interactive PowerShell session to prompt for federation service name and service account information.
- If running in an automated environment, ensure that the
-FederationServiceNameparameter is used to override automatic detection.
What to do when stuck:
- Check the ADFS module is installed and available.
- Verify that the federation service name and service account are correctly configured.
| Field | Value |
|---|---|
| Vendor | Detent Point LLC |
| Product | SpnManager 0.4.0 |
| Licence | Proprietary - licensed, not sold. See LICENSE. |
| Operational impact | Read-only. Queries Active Directory and reports findings; changes nothing. |
| Rights required | Directory read access. Some providers additionally need rights to read delegation and encryption-type attributes. |
| Providers covered | AD.ADFS |
| Approval recommendation | Approve for general operational use. It cannot alter directory state. |
Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.
| What | Why |
|---|---|
| Windows PowerShell 5.1 or later | Declared by the module manifest. |
| ActiveDirectory 1.0.0.0 | Required module. Ships with RSAT; install the Active Directory PowerShell feature. |
| A reachable domain controller | Every provider reads from Active Directory. |
| An account with directory read access | Needed to enumerate accounts and their SPNs. |
Data handling and compliance requirements:
- The cmdlet does not store or transmit sensitive data.
- No personal identifiable information (PII) is handled or stored.
- Audit trail: None (cmdlet output only).
- Compliance requirements:
- NIST SP 800-53, Rev. 5, Control AU-2 (Audit and Accountability)
- PCI-DSS v3.2.1, Requirement 10.8.3 (Secure Authentication)
This is the sense step. It reads the current state and produces a candidate; nothing is changed. Its output is normally piped into New-AdfsSpnPlan. Providers: AD.ADFS.
Example 1
Get-AdfsSpnCandidate -TargetComputer 'adfs01.corp.example.com'Senses ADFS on adfs01 using Get-AdfsProperties for the federation name.
Example 2
Get-AdfsSpnCandidate -TargetComputer 'adfs01.corp.example.com' -FederationServiceName 'adfs.corp.example.com'Automation path — bypasses Get-AdfsProperties entirely.
Example 3
Get-AdfsSpnCandidate -TargetComputer 'adfs01' -FederationServiceName 'sso.example.test' | New-AdfsSpnPlanAlso uses: New-AdfsSpnPlan (Plan).