Detent PointThe Get-PrintSpnCandidate cmdlet provides business value by ensuring that the expected SPNs (Service Principal Names) are present for a print server. This is particularly important for cluster print servers, where a virtual network name (VNN) must be accounted for.
- Who uses this: IT administrators and auditors responsible for print server setup and security.
- Risks:
- Inadequate or missing SPNs can lead to authentication issues and security vulnerabilities.
- Failing to account for VNNs in cluster environments can result in incorrect or incomplete audit plans.
- When a manager cares: During the setup and testing of new print servers, especially in clustered environments.
Day-to-Day Use
To use Get-PrintSpnCandidate, follow these steps:
- Ensure you have the SpnManager module installed and imported.
- Run
Get-PrintSpnCandidateagainst a target machine (e.g., server01). - Review the output to verify expected SPNs are present.
Code Examples
# Example usage
Get-PrintSpnCandidate -TargetComputer server01 | Format-Table -AutoSizeNote: The cmdlet targets one machine account per call, so if you’re working with a cluster print server, pass the VNN as a separate call (e.g., VNN).
Watchpoints
- Ensure the Print Spooler service is running on the target machine.
- Verify expected SPNs are present for both HOST and RPCSS.
What It Does
Get-PrintSpnCandidate checks if the expected SPNs are set up correctly for a print server. This includes checking if the Print Spooler service is running on the target machine.
Step-by-Step Recipe
- Run
Get-PrintSpnCandidateagainst a target machine. - Review the output to verify expected SPNs are present.
Getting Help When Stuck
- Consult the SpnManager module documentation.
- Reach out to IT administrators or auditors for guidance on print server setup and security.
| Field | Value |
|---|---|
| Vendor | Detent Point LLC |
| Product | SpnManager 0.4.0 |
| Licence | Proprietary - licensed, not sold. See LICENSE. |
| Operational impact | Read-only. Queries Active Directory and reports findings; changes nothing. |
| Rights required | Directory read access. Some providers additionally need rights to read delegation and encryption-type attributes. |
| Providers covered | AD.PrintSpooler |
| Approval recommendation | Approve for general operational use. It cannot alter directory state. |
Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.
| What | Why |
|---|---|
| Windows PowerShell 5.1 or later | Declared by the module manifest. |
| ActiveDirectory 1.0.0.0 | Required module. Ships with RSAT; install the Active Directory PowerShell feature. |
| A reachable domain controller | Every provider reads from Active Directory. |
| An account with directory read access | Needed to enumerate accounts and their SPNs. |
Get-PrintSpnCandidate handles sensitive data related to print server setup and security. It does not directly handle or transmit sensitive data, but rather reports on its presence.
- Data handling: Reports on expected SPNs.
- Transit: No transit of sensitive data occurs within the cmdlet.
- At-rest: Expected SPNs are present on the target machine.
- Audit trail: Review output to verify expected SPNs are present.
This is the sense step. It reads the current state and produces a candidate; nothing is changed. Its output is normally piped into New-PrintSpnAuditPlan. Providers: AD.PrintSpooler.
Example 1
Get-PrintSpnCandidate -TargetComputer 'printserver01'Example 2
Get-PrintSpnCandidateChecks the local machine.
Example 3
Get-PrintSpnCandidate -TargetComputer 'print01' | New-PrintSpnAuditPlanAlso uses: New-PrintSpnAuditPlan (Plan).