Get-SapSpnAudit

This command provides a read-only audit of the AD-side SAP SSO SPN posture for a SAP SNC + SPNEGO host. The primary use case is to identify potential security risks related to the mapping of service accounts in Active Directory.

• Key benefits:
  • Identifies potential security risks
  • Provides visibility into AD-side SAP SSO SPN posture
• Who uses this:
  • Security teams
  • IT administrators responsible for SAP systems
• Risks:
  • Non-compliance with SAP security guidelines
  • Potential for unauthorized access to SAP systems
• When a manager cares:
  • During regular security audits and risk assessments
  • After changes to SAP infrastructure or configuration

Step-by-Step Use Case

1. Run the Get-SapSpnAudit command on the target host.
2. The command will resolve the FQDN and NetBIOS short name of the target host.
3. It will build the expected SAP SSO SPN set across both family legs (SPNEGO and SNC).
4. The command will search AD for the account that currently carries the primary SAP/ and/or HTTP/ SPN.

Get-SapSpnAudit -TargetComputer 'sap01.corp.example.test'

Output

The output of the Get-SapSpnAudit command is a list of audit outcomes, which can be one of the following:

• Success: Expected SPNs present and no legacy-only enc-type posture.
• Warning: Expected SPNs not present or legacy-only enc-type posture.

Note: The output will never include sensitive information such as keytabs or secrets.

What is this Command?

This command audits the AD-side SAP SSO SPN posture for a SAP SNC + SPNEGO host. It checks if the expected SPNs are present in Active Directory and reports any potential security risks.

Step-by-Step Recipe

1. Identify the target host.
2. Run the Get-SapSpnAudit command on the target host.
3. Review the output to identify potential security risks.

What to Do When Stuck?

• Consult the documentation for troubleshooting tips.
• Contact the support team if you need further assistance.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

Data Handling

The Get-SapSpnAudit command never mints, reads, writes, redistributes, or holds a keytab or any secret. It is designed as a read-only, audit-only provider.

Transit and At-Rest

Sensitive information such as keytabs or secrets are not transmitted or stored by the Get-SapSpnAudit command.

Audit Trail

The output of the Get-SapSpnAudit command provides an audit trail of potential security risks related to AD-side SAP SSO SPN posture.

Compliance Requirements

• Follows industry-standard practices for securing SAP systems and Active Directory.
• Meets or exceeds compliance requirements for data handling, transit, and at-rest storage.