Detent Point

SpnManager Kerberos SPN auditing and repair for Active Directory

Invoke-SqlSpnExecutionEngine

The Invoke-SqlSpnExecutionEngine cmdlet executes an SPN plan by running a series of steps to ensure that the plan is properly registered and configured in...

Available today in SqlSpnManager

SQL Server is where this work started. Invoke-SqlSpnExecutionEngine ships in SqlSpnManager, on the PowerShell Gallery now — Install-Module SqlSpnManager. You can run it today.

SPN Manager takes the same approach across the rest of the directory, 26 service families in all. How the two products relate long term is not settled, and the free edition’s scope may narrow toward auditing in a future release. Any version you install stays yours — the Gallery keeps published versions available.

The Invoke-SqlSpnExecutionEngine cmdlet executes an SPN plan by running a series of steps to ensure that the plan is properly registered and configured in the forest. This process involves checking for existing registrations, resolving conflicts, and registering new SPNs.

  • Business value: Ensures that SQL Server services are properly configured with Service Principal Names (SPNs) to facilitate secure communication.
  • Who uses this:
    • System administrators responsible for managing SQL Server deployments
    • Security teams responsible for ensuring proper configuration of security-related settings
  • Risks:
    • Inadequate SPN configuration can lead to security vulnerabilities and authentication issues
    • Failure to properly register SPNs can result in service outages or other operational problems
  • When a manager cares: When there are issues with SQL Server services not being able to authenticate, or when there are concerns about the security of the forest.

To use Invoke-SqlSpnExecutionEngine, follow these steps:

  1. Import the SpnManager module: Import-Module -Name SpnManager
  2. Create an SPN plan using a cmdlet like New-SpnPlan and store it in a variable
  3. Call Invoke-SqlSpnExecutionEngine with the plan as input, e.g.:
$plan = New-SpnPlan ...
Invoke-SqlSpnExecutionEngine -Plan $plan

Common patterns include:

  • Using -SkipPreflight to skip permission checks and proceed with registration
  • Specifying -ReconcileConflicts to automatically move misregistered SPNs to their correct location

This cmdlet helps ensure that SQL Server services are properly configured with Service Principal Names (SPNs). Here’s what it does in simple terms:

  1. Checks if the plan is already registered in the forest
  2. Resolves any conflicts between existing registrations and the planned registration
  3. Registers new SPNs as specified in the plan

If you encounter issues, try:

  • Checking the event log for errors related to SPN configuration
  • Verifying that the plan is correctly formatted and contains all necessary information
  • Contacting a system administrator or security expert for assistance
Field Value
Vendor Detent Point LLC
Product SpnManager 0.4.0
Licence Proprietary - licensed, not sold. See LICENSE.
Operational impact CHANGES directory state. Registers or removes Service Principal Names on Active Directory accounts.
Rights required Write access to the target account’s servicePrincipalName attribute.
Providers covered SQL.Engine
Approval recommendation Approve for use by directory administrators, through change control. Preview with -WhatIf before any scheduled use.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

What Why
Windows PowerShell 5.1 or later Declared by the module manifest.
ActiveDirectory 1.0.0.0 Required module. Ships with RSAT; install the Active Directory PowerShell feature.
A reachable domain controller Every provider reads from Active Directory.
An account with directory read access Needed to enumerate accounts and their SPNs.
Rights to write servicePrincipalName Only for the write path. Audit and hand-off operations do not need it.

This cmdlet handles data in accordance with standard Windows security practices. The following considerations are relevant:

  • Data at rest: SPNs are stored in the forest’s directory service
  • Data in transit: SPNs are transmitted over secure channels (e.g. encrypted LDAP)
  • Audit trail: This cmdlet generates events in the Windows event log for audit purposes
  • Compliance requirements:
    • Meet Windows security and compliance standards (e.g. HIPAA, PCI-DSS)

This is the execute step. It is the point at which Active Directory is changed. Providers: SQL.Engine.

This command changes Active Directory. Run it with -WhatIf first to see exactly which SPNs would be registered or removed.

Example 1

$plan | Invoke-SqlSpnExecutionEngine -WhatIf

Example 2

$plan | Invoke-SqlSpnExecutionEngine -SkipPreflight

Example 3

$result = $plan | Invoke-SqlSpnExecutionEngine -PassThru
$result.OverallStatus      # e.g. AllRegistered | Completed | PartialFailure
$result.Spns | Where-Object Action -eq 'Failed'