Get-IisSpnCandidate

As a manager, the Get-IisSpnCandidate command from the SpnManager module provides valuable insights into IIS site bindings and their associated HTTP SPN candidates. This information is crucial for ensuring proper Kerberos authentication and authorization in your organization.

• Who uses this: IT administrators, security engineers, and DevOps teams responsible for configuring and managing IIS sites.
• Risks:
  • Inadequate or incorrect configuration of IIS site bindings can lead to authentication failures and security breaches.
  • Failure to detect and correct SPN issues can result in delayed troubleshooting and resolution.
• When a manager cares: During:
  • Initial setup and configuration of new IIS sites.
  • Periodic reviews and updates of existing IIS configurations.
  • Incident response and root cause analysis for authentication-related issues.

To use Get-IisSpnCandidate, follow these steps:

1. Ensure the SpnManager module is installed on your system.
2. Connect to an IIS server or a remote PowerShell session using the -Bindings parameter for test injection:

$bindings = @(
    [PSCustomObject]@{
        HostHeader = "example.com"
        Port       = 80
        AppPoolAccount = "myapppoolaccount"
    },
    [PSCustomObject]@{
        HostHeader = ""
        Port       = 8080
        AppPoolAccount = "anotheraccount"
    }
)
Get-IisSpnCandidate -Bindings $bindings

3. Monitor for output indicating potential SPN issues:

SPN Candidates:
+ http/example.com
+ http/example.com:80

Get-IisSpnCandidate helps detect IIS site bindings and identifies potential HTTP SPN candidates. Follow these simple steps to use this command:

1. Install the SpnManager module on your system.
2. Connect to an IIS server or a remote PowerShell session.
3. Use the -Bindings parameter for test injection (optional).
4. Run Get-IisSpnCandidate to get the SPN candidates.

If you encounter issues, ensure:

• The SpnManager module is installed correctly.
• You have the necessary permissions to access IIS configurations.
• The input bindings are formatted correctly.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

Data handling and compliance requirements:

• Data transit: This command does not transmit sensitive data.
• Data at rest: The output is stored in memory only; no files are created or modified.
• Audit trail: Log entries are generated only for errors and warnings.
• Compliance requirements:
  • DR-563: Default Windows Kerberos clients request HTTP/ with no port.
  • GR-522: Multiple bindings sharing the same app pool account are grouped into a single candidate.