SpnManager Kerberos SPN auditing and repair for Active Directory

Get-SpnProvider

The Get-SpnProvider command is a crucial tool for administrators who manage Service Principal Name (SPN) providers within the SpnManager module. This comma...

The Get-SpnProvider command is a crucial tool for administrators who manage Service Principal Name (SPN) providers within the SpnManager module. This command helps identify and validate registered SPN providers, ensuring that they are correctly configured and up-to-date.

Here are some key points to consider when using this command:

  • Who uses this: Administrators responsible for managing SPN providers in the SpnManager environment.
  • Business value: Accurate identification of registered SPN providers ensures seamless integration with services and minimizes errors caused by outdated or incorrect configurations.
  • Risks:
    • Inaccurate provider registration can lead to service disruptions.
    • Failure to update providers can result in security vulnerabilities.

To use the Get-SpnProvider command, follow these steps:

  1. Retrieve All Providers

    Get-SpnProvider

    This will return all registered SPN providers.

  2. Filter Providers by Type

    Get-SpnProvider -ServiceClass 'Custom'
  3. View Specific Provider Metadata

    Get-SpnProvider -ProviderId 'Provider-123' | Format-List *

    Replace Provider-123 with the actual ID of the provider you want to view.

The Get-SpnProvider command is used to retrieve a list of registered SPN providers in the SpnManager environment. Here’s how it works:

  1. What it does: Retrieves a list of all or filtered SPN providers, along with their associated metadata.
  2. Step-by-Step:
    • The command loads data from the providers.json file.
    • It then filters and formats the data based on any provided parameters (e.g., type).
  3. When Stuck: If you encounter issues while using this command, ensure that your providers.json is up-to-date and accurately reflects the registered SPN providers in your environment.
Field Value
Vendor Detent Point LLC
Product SpnManager 0.4.0
Licence Proprietary - licensed, not sold. See LICENSE.
Operational impact Read-only. Queries Active Directory and reports findings; changes nothing.
Rights required Directory read access.
Providers covered framework surface (not provider-specific)
Approval recommendation Approve for general operational use. It cannot alter directory state.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

What Why
Windows PowerShell 5.1 or later Declared by the module manifest.
ActiveDirectory 1.0.0.0 Required module. Ships with RSAT; install the Active Directory PowerShell feature.
A reachable domain controller Every provider reads from Active Directory.
An account with directory read access Needed to enumerate accounts and their SPNs.

The Get-SpnProvider command adheres to the following compliance requirements:

  • Data Handling: The command retrieves and formats data from the providers.json file without modifying it.
  • Transit: No sensitive information is transmitted over networks or saved in external storage.
  • At Rest: Provider metadata is stored securely within the providers.json file, ensuring that access is controlled through module permissions.
  • Audit Trail: Changes to registered SPN providers are tracked through standard PowerShell auditing mechanisms and module logs.

Example 1

Get-SpnProvider

Returns all 19 registered providers.

Example 2

Get-SpnProvider -ProviderId 'SQL.Engine'

Returns the SQL Server Engine provider entry.

Example 3

Get-SpnProvider -Status 'Implemented'

Returns only providers that have a working implementation.

Example 4

Get-SpnProvider -Phase 1

Returns the five Phase 1 machine-account audit providers.

Example 5

Get-SpnProvider -ServiceClass 'HTTP'

Returns all providers that register HTTP SPNs (SSRS, IIS, ADFS, Exchange, SharePoint).