SpnManager Kerberos SPN auditing and repair for Active Directory

Get-SqlSpnPolicyConfig

Business value for Get-SqlSpnPolicyConfig lies in its ability to ensure effective account-compliance OU configuration for SQL policies.

Business value for Get-SqlSpnPolicyConfig lies in its ability to ensure effective account-compliance OU configuration for SQL policies. * Use by: + System Administrators responsible for managing SQL Server policies. + Security Teams responsible for ensuring compliance with organizational policies. * Risks associated with incorrect configuration: + Non-compliant environments due to incorrect OU settings. + Potential security breaches if not configured correctly. * A manager cares when: + Ensuring correct OU configuration is crucial for maintaining organizational compliance and preventing security risks.

To use Get-SqlSpnPolicyConfig, follow these steps:

  1. Import the SpnManager module using Import-Module.
  2. Run Get-SqlSpnPolicyConfig to retrieve the effective account-compliance OU configuration.
  3. Use the returned hashtable values for ServiceAccountOU and GmsaOU keys in your SQL policy configurations.

Example code:

Import-Module SpnManager

$config = Get-SqlSpnPolicyConfig
Write-Host "ServiceAccountOU: $($config.ServiceAccountOU)"
Write-Host "GmsaOU: $($config.GmsaOU)"

Watchpoints:

  • Ensure the module is imported before running Get-SqlSpnPolicyConfig.
  • Be aware of the resolution order for OU configurations and adjust accordingly.

Get-SqlSpnPolicyConfig retrieves the effective account-compliance OU configuration for SQL policies. To use it, follow these simple steps: 1. Import the SpnManager module using Import-Module. 2. Run Get-SqlSpnPolicyConfig to retrieve the OU configuration. 3. Use the returned values in your SQL policy configurations.

When stuck:

  • Check that the module is imported correctly.
  • Verify that the OU configuration is set up correctly according to organizational policies.
Field Value
Vendor Detent Point LLC
Product SpnManager 0.4.0
Licence Proprietary - licensed, not sold. See LICENSE.
Operational impact Read-only. Queries Active Directory and reports findings; changes nothing.
Rights required Directory read access.
Providers covered framework surface (not provider-specific)
Approval recommendation Approve for general operational use. It cannot alter directory state.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

What Why
Windows PowerShell 5.1 or later Declared by the module manifest.
ActiveDirectory 1.0.0.0 Required module. Ships with RSAT; install the Active Directory PowerShell feature.
A reachable domain controller Every provider reads from Active Directory.
An account with directory read access Needed to enumerate accounts and their SPNs.

Get-SqlSpnPolicyConfig handles data: * In transit: secure protocols used to retrieve OU configuration. * At-rest: stored securely according to organizational policies. Audit trail: * Maintained through module logs and event logging. Compliance requirements:

  • Organizational policies must be followed for correct OU configuration.
  • Regular review of OU configurations is recommended to ensure compliance.

Example 1

Get-SqlSpnPolicyConfig

Returns the OU roots currently in force (session override, env file, or defaults).

Example 2

Get-SqlSpnPolicyConfig

Example 3

Get-SqlSpnPolicyConfig | Format-List