Business value for Get-SqlSpnPolicyConfig lies in its ability to ensure effective account-compliance OU configuration for SQL policies. * Use by: + System Administrators responsible for managing SQL Server policies. + Security Teams responsible for ensuring compliance with organizational policies. * Risks associated with incorrect configuration: + Non-compliant environments due to incorrect OU settings. + Potential security breaches if not configured correctly. * A manager cares when: + Ensuring correct OU configuration is crucial for maintaining organizational compliance and preventing security risks.
To use Get-SqlSpnPolicyConfig, follow these steps:
- Import the SpnManager module using
Import-Module. - Run
Get-SqlSpnPolicyConfigto retrieve the effective account-compliance OU configuration. - Use the returned hashtable values for ServiceAccountOU and GmsaOU keys in your SQL policy configurations.
Example code:
Import-Module SpnManager
$config = Get-SqlSpnPolicyConfig
Write-Host "ServiceAccountOU: $($config.ServiceAccountOU)"
Write-Host "GmsaOU: $($config.GmsaOU)"Watchpoints:
- Ensure the module is imported before running Get-SqlSpnPolicyConfig.
- Be aware of the resolution order for OU configurations and adjust accordingly.
Get-SqlSpnPolicyConfig retrieves the effective account-compliance OU configuration for SQL policies. To use it, follow these simple steps: 1. Import the SpnManager module using Import-Module. 2. Run Get-SqlSpnPolicyConfig to retrieve the OU configuration. 3. Use the returned values in your SQL policy configurations.
When stuck:
- Check that the module is imported correctly.
- Verify that the OU configuration is set up correctly according to organizational policies.
| Field | Value |
|---|---|
| Vendor | Detent Point LLC |
| Product | SpnManager 0.4.0 |
| Licence | Proprietary - licensed, not sold. See LICENSE. |
| Operational impact | Read-only. Queries Active Directory and reports findings; changes nothing. |
| Rights required | Directory read access. |
| Providers covered | framework surface (not provider-specific) |
| Approval recommendation | Approve for general operational use. It cannot alter directory state. |
Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.
| What | Why |
|---|---|
| Windows PowerShell 5.1 or later | Declared by the module manifest. |
| ActiveDirectory 1.0.0.0 | Required module. Ships with RSAT; install the Active Directory PowerShell feature. |
| A reachable domain controller | Every provider reads from Active Directory. |
| An account with directory read access | Needed to enumerate accounts and their SPNs. |
Get-SqlSpnPolicyConfig handles data: * In transit: secure protocols used to retrieve OU configuration. * At-rest: stored securely according to organizational policies. Audit trail: * Maintained through module logs and event logging. Compliance requirements:
- Organizational policies must be followed for correct OU configuration.
- Regular review of OU configurations is recommended to ensure compliance.
Example 1
Get-SqlSpnPolicyConfigReturns the OU roots currently in force (session override, env file, or defaults).
Example 2
Get-SqlSpnPolicyConfigExample 3
Get-SqlSpnPolicyConfig | Format-List