Detent Point

SpnManager Kerberos SPN auditing and repair for Active Directory

Invoke-SpnDuplicateScan

As a manager, you care when duplicate Service Principal Names (SPNs) are found in the forest because they can lead to authentication issues and security vu...

As a manager, you care when duplicate Service Principal Names (SPNs) are found in the forest because they can lead to authentication issues and security vulnerabilities. Duplicate SPNs occur when multiple Active Directory accounts have the same SPN, which can cause confusion and make it difficult for systems to authenticate correctly.

Some common use cases where managers may be interested in this feature include:

  • Preparing for audits or compliance checks
  • Troubleshooting authentication issues
  • Identifying security vulnerabilities

To use Invoke-SpnDuplicateScan, follow these steps:

  1. Run the command with no parameters: ```powershell Invoke-SpnDuplicateScan
2.  The command will emit a warning before starting the scan. This is normal and indicates that setspn -X queries all objects in the forest.
3.  To suppress this warning, use the `-Force` parameter:
    ```powershell
Invoke-SpnDuplicateScan -Force

The output of Invoke-SpnDuplicateScan will be a collection of SpnDuplicate objects, where each object contains the SPN and the two AD accounts that both carry it.

Watchpoints:

  • Be cautious when running this command on large directories as it can be slow.
  • Use the -Force parameter to suppress warnings in automated pipelines.

In simple terms, Invoke-SpnDuplicateScan checks for duplicate SPNs across the entire forest using setspn -X. This is useful because having duplicate SPNs can cause authentication issues and security vulnerabilities.

To use this feature, follow these steps:

  1. Run the command with no parameters to scan for duplicates.
  2. The output will be a list of duplicate SPNs and the two AD accounts that both carry them.

If you encounter any issues or are unsure about how to proceed, here are some things you can try:

  • Check the event logs for any errors related to setspn -X.
  • Review the output from Invoke-SpnDuplicateScan to identify duplicate SPNs.
Field Value
Vendor Detent Point LLC
Product SpnManager 0.4.0
Licence Proprietary - licensed, not sold. See LICENSE.
Operational impact Read-only. Queries Active Directory and reports findings; changes nothing.
Rights required Directory read access.
Providers covered Audit.DuplicateSPN
Approval recommendation Approve for general operational use. It cannot alter directory state.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

What Why
Windows PowerShell 5.1 or later Declared by the module manifest.
ActiveDirectory 1.0.0.0 Required module. Ships with RSAT; install the Active Directory PowerShell feature.
A reachable domain controller Every provider reads from Active Directory.
An account with directory read access Needed to enumerate accounts and their SPNs.

The Invoke-SpnDuplicateScan cmdlet does not handle sensitive data in any way, so there are no specific compliance requirements. However, it is essential to ensure that all output from this cmdlet is properly audited and tracked.

Transit:

  • No data is transmitted by default.
  • Any generated output should be treated as log data.

At Rest:

  • No sensitive data is stored by the cmdlet.

Audit Trail:

  • The cmdlet logs all warnings and errors to the event logs.
  • Output from the cmdlet can be used for auditing purposes.

This is the sense step. It reads the current state and produces a candidate; nothing is changed. Providers: Audit.DuplicateSPN.

Example 1

Invoke-SpnDuplicateScan

Scans the current domain with a performance warning.

Example 2

Invoke-SpnDuplicateScan -Force

Scans silently — suitable for scheduled audit jobs.

Example 3

Invoke-SpnDuplicateScan -Domain 'corp.example.com'

Scans a specific domain.