Detent Point

SpnManager Kerberos SPN auditing and repair for Active Directory

Get-SsasSpnCandidate

+ Database administrators

  • The Get-SsasSpnCandidate cmdlet is used to detect SQL Server Analysis Services (SSAS) instances on a target machine and returns Service Principal Name (SPN) candidates.
  • Business value: Ensures that Kerberos authentication works for SSAS instances, which is crucial for secure communication between the client and server.
  • Users:
    • Database administrators
    • Security teams
    • System administrators
  • Risks:
    • Insecure SPNs can lead to authentication issues and data breaches.
    • Failure to detect SSAS instances can result in incomplete or incorrect SPN configuration.
  • When a manager cares:
    • When deploying new SSAS instances.
    • During security audits and compliance checks.
    • When experiencing Kerberos-related authentication issues.
  1. Run the Get-SsasSpnCandidate cmdlet on the target machine:
Get-SsasSpnCandidate
  1. The cmdlet queries Win32_Service via CIM for SSAS services and reads configured ports from the Windows Registry.
  2. Emissions per DR-562 are generated based on the instance type (default or named) and service account configuration.

Note: Make sure to run this cmdlet with sufficient permissions to access the target machine’s registry and services.

  1. What does Get-SsasSpnCandidate do?
    • Detects SSAS instances on a target machine.
    • Generates SPN candidates based on instance type (default or named) and service account configuration.
  2. Step-by-step recipe:
    1. Run the cmdlet on the target machine.
    2. Review emissions per DR-562 for correct SPN configuration.
  3. What to do when stuck?
    • Check permissions to access registry and services.
    • Verify SSAS instance configuration.
Field Value
Vendor Detent Point LLC
Product SpnManager 0.4.0
Licence Proprietary - licensed, not sold. See LICENSE.
Operational impact Read-only. Queries Active Directory and reports findings; changes nothing.
Rights required Directory read access. Some providers additionally need rights to read delegation and encryption-type attributes.
Providers covered SQL.SSAS
Approval recommendation Approve for general operational use. It cannot alter directory state.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

What Why
Windows PowerShell 5.1 or later Declared by the module manifest.
ActiveDirectory 1.0.0.0 Required module. Ships with RSAT; install the Active Directory PowerShell feature.
A reachable domain controller Every provider reads from Active Directory.
An account with directory read access Needed to enumerate accounts and their SPNs.
  • Data-handling: The cmdlet only reads data from the Windows Registry and does not store or transmit any sensitive information.
  • Transit: No sensitive data is transmitted over the network.
  • At-rest: SPN candidates are generated based on local configuration, without storing any sensitive data.
  • Audit trail: Emissions per DR-562 provide an audit trail for correct SPN configuration.
  • Compliance requirements:
    • Ensure Kerberos authentication works for SSAS instances (DR-562).

This is the sense step. It reads the current state and produces a candidate; nothing is changed. Its output is normally piped into New-SsasSpnPlan. Providers: SQL.SSAS.

Example 1

Get-SsasSpnCandidate

Returns SSAS SPN candidates for the local machine.

Example 2

Get-SsasSpnCandidate -TargetComputer 'srv01.corp.example.com'

Returns SSAS SPN candidates for the specified remote computer.

Example 3

Get-SsasSpnCandidate -TargetComputer 'olap01.corp.example.com' | New-SsasSpnPlan

Senses SSAS instances and pipes each candidate into the plan builder.

Also uses: New-SsasSpnPlan (Plan).