Detent PointThe Get-LinuxJoinedSpnAudit cmdlet provides visibility into the AD-side HOST SPN posture for Linux hosts joined to AD. This is particularly useful for organizations with a mix of Windows and Linux systems in their Active Directory environment.
Managers should care about this audit when:
- They are planning or have recently implemented AES hardening on their KDC policy
- They need to ensure that all systems, including Linux, are properly configured to use AD-joined service accounts
- They are looking for opportunities to improve the security posture of their Active Directory environment
Here’s a step-by-step guide on how to use Get-LinuxJoinedSpnAudit:
- Run the cmdlet with no parameters:
Get-LinuxJoinedSpnAuditThis will return a list of audit outcomes for each Linux host joined to AD.
- Filter the results by specific host or hosts:
Get-LinuxJoinedSpnAudit -TargetComputer 'linux01.corp.example.test'- Check the output format, which includes expected and actual SPNs, as well as any errors encountered during the audit.
Watchpoints:
- Ensure that the AD COMPUTER object for each Linux host is accessible and up-to-date.
- Verify that the HOST SPN set is correctly configured on each Linux host.
Get-LinuxJoinedSpnAudit checks the AD-side HOST SPN posture for Linux hosts joined to AD. Here’s how it works:
- The cmdlet resolves the FQDN and NetBIOS short name of the target host.
- It builds the expected HOST SPN set based on the host’s AD COMPUTER object.
- It compares the expected and actual SPNs, reporting any discrepancies.
If you’re getting stuck:
- Check that the AD COMPUTER object is accessible and up-to-date.
- Verify that the HOST SPN set is correctly configured on each Linux host.
| Field | Value |
|---|---|
| Vendor | Detent Point LLC |
| Product | SpnManager 0.4.0 |
| Licence | Proprietary - licensed, not sold. See LICENSE. |
| Operational impact | Read-only. Queries Active Directory and reports findings; changes nothing. |
| Rights required | Directory read access. Some providers additionally need rights to read delegation and encryption-type attributes. |
| Providers covered | AD.LinuxJoined |
| Approval recommendation | Approve for general operational use. It cannot alter directory state. |
Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.
| What | Why |
|---|---|
| Windows PowerShell 5.1 or later | Declared by the module manifest. |
| ActiveDirectory 1.0.0.0 | Required module. Ships with RSAT; install the Active Directory PowerShell feature. |
| A reachable domain controller | Every provider reads from Active Directory. |
| An account with directory read access | Needed to enumerate accounts and their SPNs. |
Get-LinuxJoinedSpnAudit handles data as follows:
- In transit: Uses secure protocol (HTTPS) and authentication (AD credentials).
- At rest: Stores no sensitive information.
- Audit trail: Logs all operations, including errors and discrepancies.
Compliance requirements:
- Meet or exceed applicable laws and regulations regarding AD security and keytab management.
This is the sense step. It reads the current state and produces a candidate; nothing is changed. Providers: AD.LinuxJoined.
Example 1
Get-LinuxJoinedSpnAudit -TargetComputer 'linux01.corp.example.test'Audits the expected HOST SPN posture on the computer object for the Linux host and returns a finding when an expected HOST SPN is missing from AD.
Example 2
Get-LinuxJoinedSpnAudit -TargetComputer 'linux01' | Where-Object MissingSpnsReturns the audit only when there is an AD-side HOST SPN gap to act on.
Example 3
Get-LinuxJoinedSpnAudit -TargetComputer 'linux01.corp.example.test' | Export-LinuxJoinedSpnRunbookRenders the operator hand-off runbook (host-local keytab refresh steps)
for the finding.
Also uses: Export-LinuxJoinedSpnRunbook (Handoff).