Detent PointGet-SsrsSpnCandidate is used to detect SQL Server Reporting Services (SSRS) and return HTTP SPN candidates. This command is useful for organizations that use SSRS and need to configure Service Principal Names (SPNs).
- Use cases:
- Detecting potential security risks in SSRS configurations.
- Automating the process of configuring SPNs for SSRS services.
- Risks:
- Incorrectly configured SPNs can lead to security vulnerabilities.
- Failure to detect potential issues can result in data breaches or service outages.
- When a manager cares:
- During deployments or upgrades of SSRS services.
- When troubleshooting security-related issues with SSRS.
To use Get-SsrsSpnCandidate, follow these steps:
- Ensure the SpnManager module is installed and imported.
Import-Module -Name 'SpnManager'- Run the Get-SsrsSpnCandidate cmdlet to detect SSRS and return HTTP SPN candidates.
$srsCandidates = Get-SsrsSpnCandidate- Review the output to identify potential security risks or configuration issues.
Watchpoints:
- Be cautious when using the -ConfigPath override, as it can skip the search for the rsreportserver.config file.
- Ensure that the SpnManager module is up-to-date to avoid any known issues or bugs.
Get-SsrsSpnCandidate detects SQL Server Reporting Services (SSRS) and returns HTTP SPN candidates. Here’s a simplified step-by-step guide:
- Use Get-SsrsSpnCandidate to detect SSRS and return HTTP SPN candidates.
- Review the output to identify potential security risks or configuration issues.
What to do when stuck: * Check the SpnManager module documentation for troubleshooting tips. * Reach out to the module’s author or community support for assistance.
| Field | Value |
|---|---|
| Vendor | Detent Point LLC |
| Product | SpnManager 0.4.0 |
| Licence | Proprietary - licensed, not sold. See LICENSE. |
| Operational impact | Read-only. Queries Active Directory and reports findings; changes nothing. |
| Rights required | Directory read access. Some providers additionally need rights to read delegation and encryption-type attributes. |
| Providers covered | SQL.SSRS |
| Approval recommendation | Approve for general operational use. It cannot alter directory state. |
Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.
| What | Why |
|---|---|
| Windows PowerShell 5.1 or later | Declared by the module manifest. |
| ActiveDirectory 1.0.0.0 | Required module. Ships with RSAT; install the Active Directory PowerShell feature. |
| A reachable domain controller | Every provider reads from Active Directory. |
| An account with directory read access | Needed to enumerate accounts and their SPNs. |
Get-SsrsSpnCandidate complies with the following data handling, transit, and at-rest requirements:
- Data handling: The cmdlet reads and processes configuration files without storing sensitive information.
- Transit: Configuration files are not transmitted over the network during normal operation.
- At rest: Configuration files are stored on the local file system.
Audit trail: * Get-SsrsSpnCandidate does not create an audit trail by default. Consider using additional tools or scripts to log important events.
Compliance requirements:
- Ensure that all configuration files are properly secured and accessible only to authorized personnel.
- Regularly review and update SPNs to prevent security vulnerabilities.
This is the sense step. It reads the current state and produces a candidate; nothing is changed. Its output is normally piped into New-SsrsSpnPlan. Providers: SQL.SSRS.
Example 1
Get-SsrsSpnCandidateDetects SSRS on the local machine using the default config search paths.
Example 2
Get-SsrsSpnCandidate -TargetComputer 'ssrs01.corp.example.com'Detects SSRS on the local machine and uses ‘ssrs01.corp.example.com’ as the target hostname.
Example 3
Get-SsrsSpnCandidate -ConfigPath 'D:\SSRS\ReportServer\rsreportserver.config'Uses an explicit config path instead of the automatic search.