Get-RdpSpnCandidate

Get-RdpSpnCandidate is used by IT administrators to ensure the TERMSRV SPNs for Remote Desktop Services are correctly configured on a target machine. This module helps prevent issues with remote desktop connectivity.

• Risks: Incorrectly configured TERMSRV SPNs can lead to authentication failures and impact productivity.
• When a manager cares:
  • During initial setup of Remote Desktop Services
  • After changes to the target machine’s name or IP address
  • Before scaling out Remote Desktop Services across multiple machines

Usage Scenario: Verifying TERMSRV SPNs

1. Import the SpnManager module and connect to Active Directory using a suitable cmdlet (e.g., Connect-AD).
2. Run Get-RdpSpnCandidate <target_machine_name> to retrieve one SpnCandidate for the target machine account.
3. Pass this candidate to New-RdpSpnAuditPlan for auditing.
4. Review and address any discrepancies found by the audit plan.

# Example usage
Import-Module -Name SpnManager
$splClient = Connect-SpnClient -Server 'https://example.com'
$candidate = Get-RdpSpnCandidate -TargetComputer 'target_machine'
$newAuditPlan = New-RdpSpnAuditPlan -Candidate @($candidate)

Watchpoint: Ensure the target machine’s account exists in Active Directory and has a valid UPN.

What it Does

Get-RdpSpnCandidate builds the expected TERMSRV SPNs for a target machine. These are used to ensure Remote Desktop Services work correctly.

1. Run Get-RdpSpnCandidate with the target machine’s name.
2. This cmdlet will return one SpnCandidate describing the two TERMSRV SPNs (FQDN and NetBIOS variants).
3. Pass this candidate to New-RdpSpnAuditPlan for auditing.

When You’re Stuck

• Check that the target machine account exists in Active Directory with a valid UPN.
• Verify the module is correctly imported and connected to Active Directory.
• Review the audit plan generated by New-RdpSpnAuditPlan.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

• Data handling: This cmdlet does not manipulate or modify Active Directory data.
• Transit: No sensitive data is transmitted by this cmdlet.
• At rest: TERMSRV SPNs are stored in the target machine’s account in Active Directory.
• Audit trail: Use New-RdpSpnAuditPlan to generate an audit plan and track discrepancies over time.