Detent Point

SpnManager Kerberos SPN auditing and repair for Active Directory

Get-SharePointSpnCandidate

As a manager responsible for SharePoint security and access management, you should be aware of the Get-SharePointSpnCandidate command from the SpnManager m...

As a manager responsible for SharePoint security and access management, you should be aware of the Get-SharePointSpnCandidate command from the SpnManager module. This command helps identify potential HTTP SPN candidates for SharePoint web application AAM URLs.

The business value of this command lies in its ability to:

  • Identify potential security risks related to missing or duplicate HTTP SPNs
  • Ensure compliance with GR-532, which requires all AAM URLs to have corresponding HTTP SPNs

Who uses this command:

  • SharePoint administrators and security teams
  • Information Security officers responsible for maintaining compliance with regulatory requirements

Risks associated with not using this command include:

  • Missing or duplicate HTTP SPNs leading to security vulnerabilities
  • Non-compliance with GR-532, which can result in fines and reputational damage

When a manager cares:

  • When there are reports of security incidents related to SharePoint access management
  • When compliance audits reveal non-compliance with regulatory requirements

To use the Get-SharePointSpnCandidate command, follow these steps:

  1. Ensure you have the SpnManager module installed and imported.
  2. Run the command with the -WebApplicationData injection parameter for unit testing (optional).
  3. The command will enumerate SharePoint web applications using Get-SPWebApplication (requires Microsoft.SharePoint.PowerShell snap-in) or query AD users for existing HTTP SPNs as a partial fallback.

Example code:

Get-SharePointSpnCandidate -WebApplicationData $webAppData

Watchpoints:

  • Ensure the SpnManager module is up-to-date.
  • Be aware of potential performance impact when enumerating SharePoint web applications.

In simple terms, the Get-SharePointSpnCandidate command helps identify potential HTTP SPN candidates for SharePoint web application AAM URLs. This ensures compliance with GR-532 and reduces security risks related to missing or duplicate HTTP SPNs.

Step-by-step recipe:

  1. Import the SpnManager module.
  2. Run the Get-SharePointSpnCandidate command with the -WebApplicationData injection parameter (optional).
  3. Review the output for potential issues.

What to do when stuck:

  • Refer to the SpnManager module documentation and online resources.
  • Contact the SharePoint administration team or IT support for assistance.
Field Value
Vendor Detent Point LLC
Product SpnManager 0.4.0
Licence Proprietary - licensed, not sold. See LICENSE.
Operational impact Read-only. Queries Active Directory and reports findings; changes nothing.
Rights required Directory read access. Some providers additionally need rights to read delegation and encryption-type attributes.
Providers covered AD.SharePoint
Approval recommendation Approve for general operational use. It cannot alter directory state.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

What Why
Windows PowerShell 5.1 or later Declared by the module manifest.
ActiveDirectory 1.0.0.0 Required module. Ships with RSAT; install the Active Directory PowerShell feature.
A reachable domain controller Every provider reads from Active Directory.
An account with directory read access Needed to enumerate accounts and their SPNs.

This command handles sensitive data related to SharePoint web application AAM URLs and potential security risks. The output includes:

  • Identifiers for sensitive data (HTTP SPN candidates)
  • Information about the sources of sensitive data (AD users, SharePoint web applications)

Transit and at-rest requirements:

  • Sensitive data is stored in memory temporarily during execution
  • No storage of sensitive data is performed

Audit trail:

  • Command execution logs are generated by default (check module settings for configuration)

Compliance requirements:

  • GR-532 compliance ensured through enumeration of SharePoint web applications and identification of potential security risks

This is the sense step. It reads the current state and produces a candidate; nothing is changed. Its output is normally piped into New-SharePointSpnPlan. Providers: AD.SharePoint.

Example 1

Get-SharePointSpnCandidate

Enumerates SharePoint web applications on the local farm.

Example 2

$d = @([PSCustomObject]@{HostHeader='sp.corp.example.com'; AppPoolAccount='corp\svc-sp'})
Get-SharePointSpnCandidate -WebApplicationData $d

Uses injected data — no snap-in required. Useful in test contexts.

Example 3

Get-SharePointSpnCandidate -WebApplicationData $webApps | New-SharePointSpnPlan

Also uses: New-SharePointSpnPlan (Plan).