SpnManager Kerberos SPN auditing and repair for Active Directory

Get-SqlSpnInfrastructure

+ Authentication issues

Available today in SqlSpnManager

SQL Server is where this work started. Get-SqlSpnInfrastructure ships in SqlSpnManager, on the PowerShell Gallery now — Install-Module SqlSpnManager. You can run it today.

SPN Manager takes the same approach across the rest of the directory, 26 service families in all. How the two products relate long term is not settled, and the free edition’s scope may narrow toward auditing in a future release. Any version you install stays yours — the Gallery keeps published versions available.

  • The Get-SqlSpnInfrastructure cmdlet is used to resolve SPN-relevant infrastructure facts for a target SQL host or virtual name.
  • This command is typically used by database administrators who need to manage the naming conventions for their SQL Server instances.
  • Risks associated with incorrect SPN configuration include:
    • Authentication issues
    • Data corruption
    • System crashes
  • Managers should be concerned when:
    • Database administrators are unable to resolve SPNs for new instances
    • There are issues with authentication or data consistency

Using the cmdlet:

  1. Run Get-SqlSpnInfrastructure -Target <SQLInstanceName> to retrieve infrastructure facts for a specific SQL instance.
  2. Use the ResolveFQDN parameter to resolve the FQDN from a shortname using the local domain.
  3. The PropagateScenarioTag parameter can be used to propagate the scenario tag (Standalone / AlwaysOn / FCI) through to the plan builder.
Get-SqlSpnInfrastructure -TargetName "SQLInstance1" 
  -ResolveFQDN:$true 
  -PropagateScenarioTag:"AlwaysOn"
  • Watchpoint: Ensure that the target SQL instance is properly configured and running before attempting to resolve its infrastructure facts.
  • Common patterns:
    • Using Get-SqlSpnInfrastructure as part of a larger script to automate SPN management
    • Configuring the cmdlet to use a specific registry path for actual TCP port detection

What does this do?

  1. The cmdlet retrieves infrastructure facts for a target SQL host or virtual name.
  2. It resolves the FQDN from a shortname using the local domain.
  3. It detects cross-forest registration by comparing the target’s DNS suffix to the local USERDNSDOMAIN.

Step-by-step recipe:

  1. Run Get-SqlSpnInfrastructure -Target <SQLInstanceName> in PowerShell.
  2. Review the output for infrastructure facts, such as FQDN and actual TCP port.
  3. Use the resolved facts to configure your SQL instance or plan builder.

What to do when stuck?

  • Check the cmdlet documentation for more information on parameters and usage.
  • Verify that the target SQL instance is properly configured and running.
  • Contact a database administrator or support team for assistance.
Field Value
Vendor Detent Point LLC
Product SpnManager 0.4.0
Licence Proprietary - licensed, not sold. See LICENSE.
Operational impact Read-only. Queries Active Directory and reports findings; changes nothing.
Rights required Directory read access.
Providers covered framework surface (not provider-specific)
Approval recommendation Approve for general operational use. It cannot alter directory state.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

What Why
Windows PowerShell 5.1 or later Declared by the module manifest.
ActiveDirectory 1.0.0.0 Required module. Ships with RSAT; install the Active Directory PowerShell feature.
A reachable domain controller Every provider reads from Active Directory.
An account with directory read access Needed to enumerate accounts and their SPNs.

The Get-SqlSpnInfrastructure cmdlet handles sensitive data, including:

  • SQL instance names and FQDNs
  • Actual TCP ports

Data is transmitted securely over the local network.

Data at rest is stored in memory during execution. The cmdlet does not persist any data to disk.

Audit trail: The cmdlet logs its output and any errors encountered.

Compliance requirements:

  • Ensure that sensitive data is handled according to organizational policies and procedures.
  • Implement robust authentication and authorization controls to prevent unauthorized access to sensitive data.
  • Regularly review and update the cmdlet’s dependencies and configuration to ensure compliance with relevant regulations.

Example 1

Get-SqlSpnInfrastructure -Scenario Standalone -TargetName SQLSRV01

Example 2

Get-SqlSpnInfrastructure -Scenario FCI -TargetName SQLFCI01.contoso.com -ManualPort 55001

Example 3

Get-SqlSpnInfrastructure -Scenario $scenario -TargetName 'sql01' -ManualPort 1433