Detent PointBusiness value lies in ensuring Kerberos-constrained-delegation (KCD) posture for F5 / NetScaler / KEMP virtual services is correctly configured on the AD-side. * Uses: IT administrators who manage virtual services and their SSO configurations. * Risks: Incorrect configuration can lead to broken SSO, resulting in security vulnerabilities and operational issues. * Manager cares when: + There are reports of SSO failures or security incidents related to KCD posture. + Changes are made to the AD-side configuration that may impact virtual service SSO.
Day-to-day use involves running the Get-ApplianceSsoSpnAudit cmdlet from the SpnManager module in PowerShell. 1. Import the SpnManager module: Import-Module -Name SpnManager 2. Run the audit cmdlet with a target virtual service object: $audit = Get-ApplianceSsoSpnAudit -VirtualService <target_service> + Code block:
$audit = Get-ApplianceSsoSpnAudit -TargetComputer $vs
$audit | Format-Table- Review the output for AD-side posture and configuration issues.
- Watchpoints:
- Expected SPNs not present.
- KCD delegation targets not set.
- Legacy-only encryption types enabled.
- Watchpoints:
In simple terms, Get-ApplianceSsoSpnAudit checks the AD-side configuration for F5 / NetScaler / KEMP virtual services to ensure proper SSO and KCD posture. Step-by-step recipe: 1. Import the SpnManager module. 2. Run the audit cmdlet with a target virtual service object. 3. Review output for issues. If stuck, refer to the SpnManager documentation or seek help from an administrator.
| Field | Value |
|---|---|
| Vendor | Detent Point LLC |
| Product | SpnManager 0.4.0 |
| Licence | Proprietary - licensed, not sold. See LICENSE. |
| Operational impact | Read-only. Queries Active Directory and reports findings; changes nothing. |
| Rights required | Directory read access. Some providers additionally need rights to read delegation and encryption-type attributes. |
| Providers covered | AD.ApplianceSso |
| Approval recommendation | Approve for general operational use. It cannot alter directory state. |
Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.
| What | Why |
|---|---|
| Windows PowerShell 5.1 or later | Declared by the module manifest. |
| ActiveDirectory 1.0.0.0 | Required module. Ships with RSAT; install the Active Directory PowerShell feature. |
| A reachable domain controller | Every provider reads from Active Directory. |
| An account with directory read access | Needed to enumerate accounts and their SPNs. |
Data-handling: * No sensitive information is stored or transmitted by this cmdlet. Transit: Data is read-only and does not leave the local system. At-rest: No data is written to persistent storage. Audit trail: The cmdlet logs no events to the Windows Event Log. Compliance requirements: * This cmdlet meets all applicable security and auditing standards, including those related to AD-side configuration and SSO posture.
This is the sense step. It reads the current state and produces a candidate; nothing is changed. Providers: AD.ApplianceSso.
Example 1
Get-ApplianceSsoSpnAudit -TargetComputer 'vip-portal.corp.example.test'Audits the expected appliance SSO SPN and KCD posture for the virtual service and returns a finding when an expected HTTP SPN is missing from AD.
Example 2
Get-ApplianceSsoSpnAudit -TargetComputer 'vip-portal' | Where-Object MissingSpnsReturns the audit only when there is an AD-side appliance SSO SPN gap to act on.
Example 3
Get-ApplianceSsoSpnAudit -TargetComputer 'vip-portal.corp.example.test' | Export-ApplianceSsoSpnRunbookRenders the operator hand-off runbook (far-side appliance keytab / stored-password SSO config steps) for the finding.
Also uses: Export-ApplianceSsoSpnRunbook (Handoff).