New-AdcsSpnAuditPlan

The New-AdcsSpnAuditPlan command is a key component of the AD CS infrastructure management process. Its primary purpose is to identify potential security vulnerabilities by comparing expected Service Principal Names (SPNs) with actual SPNs registered in Active Directory.

Business value:

• Ensures secure and consistent registration of service endpoints
• Helps prevent unauthorized services from accessing sensitive resources
• Facilitates compliance with industry standards and regulations

Who uses this:

• AD CS administrators responsible for managing CA infrastructure
• Security teams that monitor and audit AD environments
• Compliance officers who ensure adherence to regulatory requirements

Risks:

• Inconsistent or missing SPNs can lead to security breaches
• Failure to detect orphaned SPNs can result in unauthorized access
• Non-compliance with industry standards and regulations can attract penalties

When a manager cares:

• When an audit reveals inconsistent or missing SPNs
• When a security incident occurs due to unknown service endpoints
• When compliance reports indicate non-adherence to industry standards

To use New-AdcsSpnAuditPlan, follow these steps:

1. Run the command with the -Credential parameter to authenticate with AD:

Get-AdcsSpnCandidate -TargetComputer 'ca01.corp.example.com' | New-AdcsSpnAuditPlan

2. Filter SPNs using the -Filter parameter to narrow down results:

$candidate = Get-AdcsSpnCandidate -TargetComputer 'ca01.corp.example.com'
New-AdcsSpnAuditPlan -Candidate $candidate

3. Compute missing and orphaned SPNs using the default settings:

New-AdcsSpnAuditPlan

Watchpoints:

• Ensure AD CS infrastructure is properly configured before running this command
• Regularly review results to detect potential security vulnerabilities

Code examples:

# Sense the certificate authority, then compute missing and orphaned SPNs
$candidate = Get-AdcsSpnCandidate -TargetComputer 'ca01.corp.example.com'
$result    = New-AdcsSpnAuditPlan -Candidate $candidate

# Keep the finding for a change ticket
$result | Export-Csv -Path 'C:\Reports\adcs-spn-audit.csv' -NoTypeInformation

New-AdcsSpnAuditPlan is a PowerShell command that helps identify potential security risks in AD CS infrastructure. Here’s what it does:

1. Reads the CA machine account’s ServicePrincipalName attribute from AD.
2. Filters SPNs to RPCSS/* and HTTP/* entries only.
3. Computes missing (expected - actual) and orphaned (actual - expected) SPNs.

Simple recipe:

• Run New-AdcsSpnAuditPlan with default settings.
• Review output for missing or orphaned SPNs.

What to do when stuck:

• Check AD CS infrastructure configuration and ensure proper authentication.
• Consult PowerShell documentation for troubleshooting tips.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

The New-AdcsSpnAuditPlan command handles sensitive data securely:

• Data is retrieved from Active Directory using authenticated connections.
• Results are computed locally, minimizing transit and storage requirements.
• An audit trail is not maintained by default; consider logging options for compliance.

Compliance requirements:

• Aligns with industry standards (e.g., NIST 800-53, ISO 27001).
• Ensures data protection through secure authentication and access control.