Detent Point

SpnManager Kerberos SPN auditing and repair for Active Directory

Get-WinRmSpnCandidate

The Get-WinRmSpnCandidate command is used to build the expected WSMAN SPN set for a target machine. This is a crucial step in preparing for Windows Remote...

The Get-WinRmSpnCandidate command is used to build the expected WSMAN SPN set for a target machine. This is a crucial step in preparing for Windows Remote Management (WinRM) setup and ensuring secure remote access.

  • Who uses this: System administrators, DevOps engineers, and security specialists responsible for configuring and managing WinRM.
  • Risks: If the expected WSMAN SPN set is not correctly configured, it can lead to authentication failures, security vulnerabilities, or even denial-of-service (DoS) attacks.
  • When a manager cares: When:
    • WinRM setup is critical for business operations.
    • Security audits identify potential issues with SPNs.
    • Remote access needs are scaled up or down.

Day-to-Day Use

To use Get-WinRmSpnCandidate, follow these steps:

  1. Ensure the target machine has the SpnManager module installed.
Import-Module -Name SpnManager
  1. Run the command to get the expected WSMAN SPN set for the target machine.
Get-WinRmSpnCandidate -TargetComputer 'srv-app01' | New-WinRmSpnAuditPlan

Watchpoints:

  • Verify that the target machine has the necessary permissions and access rights.
  • Ensure the SpnManager module is up-to-date.

Common Patterns

This command is often used in conjunction with other SpnManager commands to configure WinRM settings, such as:

  • Enable-PSRemoting
  • New-WinRmSpnAuditPlan

What this does:

The Get-WinRmSpnCandidate command builds the expected WSMAN SPN set for a target machine. This ensures secure remote access and prevents potential security vulnerabilities.

Step-by-Step Recipe:

  1. Install the SpnManager module.
  2. Import the module in your PowerShell session.
  3. Run Get-WinRmSpnCandidate to get the expected WSMAN SPN set.
  4. Pipe the output to New-WinRmSpnAuditPlan for further configuration.

When Stuck:

  • Consult the SpnManager documentation or online resources.
  • Reach out to system administrators or DevOps engineers with expertise in WinRM setup and security.
Field Value
Vendor Detent Point LLC
Product SpnManager 0.4.0
Licence Proprietary - licensed, not sold. See LICENSE.
Operational impact Read-only. Queries Active Directory and reports findings; changes nothing.
Rights required Directory read access. Some providers additionally need rights to read delegation and encryption-type attributes.
Providers covered AD.WinRM
Approval recommendation Approve for general operational use. It cannot alter directory state.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

What Why
Windows PowerShell 5.1 or later Declared by the module manifest.
ActiveDirectory 1.0.0.0 Required module. Ships with RSAT; install the Active Directory PowerShell feature.
A reachable domain controller Every provider reads from Active Directory.
An account with directory read access Needed to enumerate accounts and their SPNs.

The Get-WinRmSpnCandidate command adheres to standard security practices and compliance requirements:

  • Data Handling: No sensitive data is transmitted or stored.
  • Transit: Data in transit is encrypted using secure protocols (e.g., HTTPS).
  • At Rest: Data at rest is securely stored on the target machine.
  • Audit Trail: Output from Get-WinRmSpnCandidate can be used to create an audit trail for WinRM setup and configuration.

This is the sense step. It reads the current state and produces a candidate; nothing is changed. Its output is normally piped into New-WinRmSpnAuditPlan. Providers: AD.WinRM.

Example 1

Get-WinRmSpnCandidate -TargetComputer 'jumphost01'

Example 2

Get-WinRmSpnCandidate

Example 3

Get-WinRmSpnCandidate -TargetComputer 'srv01' | New-WinRmSpnAuditPlan

Also uses: New-WinRmSpnAuditPlan (Plan).