Get-JavaSpnegoSpnAudit

This command provides business value by ensuring the security posture of Java/Tomcat/JBoss/WildFly/Hadoop SPNEGO hosts in Active Directory (AD). It audits the AD-side HTTP SPN posture for these hosts, helping to prevent authentication failures and service disruptions.

• Who uses this:
  • IT administrators responsible for managing AD and Java/SPNEGO configurations
  • Security teams monitoring AD security posture
• Risks:
  • Authentication failures due to missing or incorrect SPNs
  • Service disruptions caused by invalid or outdated SPN mappings
• When a manager cares:
  • During regular security audits and compliance checks
  • After major changes to AD or Java/SPNEGO configurations

To use this command, follow these steps:

1. Import the SpnManager module: Import-Module SpnManager
2. Run the Get-JavaSpnegoSpnAudit cmdlet against the target host:

Get-JavaSpnegoSpnAudit -TargetComputer 'wildfly01.corp.example.test'

This will output a report on the AD-side HTTP SPN posture for the specified host.

• Common patterns:
  • Auditing Java/SPNEGO hosts regularly to ensure correct SPN mappings
  • Using this cmdlet as part of a larger script or workflow to automate security audits
• Code examples:

# Get the report for a single host
Get-JavaSpnegoSpnAudit -TargetComputer my_host

# Get the reports for multiple hosts in parallel
$hosts = @("host1", "host2", "host3")
Get-JavaSpnegoSpnAudit -TargetComputer $hosts

• Watchpoints:
  • Be aware of directory failures, which will result in a clean outcome row instead of throwing an error

This command audits the AD-side HTTP SPN posture for Java/Tomcat/JBoss/WildFly/Hadoop SPNEGO hosts.

1. What it does:
   • Resolves the FQDN and NetBIOS short name for the target host
   • Builds the expected HTTP SPN set for the SPNEGO web leg (HTTP/ and HTTP/)
   • Searches AD for the account carrying the primary HTTP/ SPN
2. Step-by-step recipes:
   1. Run the Get-JavaSpnegoSpnAudit cmdlet against the target host.
   2. Review the output report to identify any issues or discrepancies.

What to do when stuck:

• Consult the SpnManager documentation and troubleshooting guides.
• Reach out to IT administrators or security teams for assistance.
• Verify that the AD configuration and Java/SPNEGO settings are correct.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

This cmdlet handles sensitive data, including:

• SPN mappings and account information
• Encrypted keytabs and passwords

Transit security: The output report is transmitted to the console or log file.

At-rest security: The output report is stored in a local log file or database.

Audit trail: This cmdlet logs its activity, including errors and warnings.

Compliance requirements:

• NIST 800-53, AU-2 (Audit Management)
• PCI DSS v3.2.1, 12.9 (Account Management)
• HIPAA, 164.312(a) (Audit Controls)