New-AdcsSpnPlan

As a manager, you should care about the New-AdcsSpnPlan command when planning for service principal name (SPN) registration in your organization’s Active Directory Certificate Services (AD CS) infrastructure. This is particularly relevant when implementing disaster recovery (DR) 524, which requires manual registration of HTTP SPNs.

Business Value

The business value lies in ensuring that your AD CS services can register their own SPNs, thus simplifying the DR process.

Who Uses This?

This command is primarily used by IT administrators responsible for managing and maintaining AD CS infrastructure.

Risks

Using this command incorrectly may lead to incomplete or incorrect registration of SPNs, potentially disrupting service availability during a disaster recovery scenario.

When a Manager Cares

A manager should care when:

• Their organization uses AD CS for issuing certificates.
• They plan to implement DR 524.
• They want to ensure their IT team is equipped with the necessary tools to handle SPN registration.

The New-AdcsSpnPlan command is used in conjunction with other commands from the SpnManager module. It builds a DR-524 SpnPlan from an ADCS SpnCandidate by resolving the CA server’s DistinguishedName from Active Directory and filtering out RPCSS/* entries.

Step-by-Step Use

1. Get the candidate using Get-AdcsSpnCandidate.
2. Pass this candidate to New-AdcsSpnPlan.
3. Inspect the proposed SPNs in ProposedSpns for correctness.
4. Manually register any missing HTTP SPNs.

Code Example

# Assuming $candidate is a valid object
$newSPNPlan = New-AdcsSpnPlan -Candidate $candidate
$newSPNPlan | Format-List

Watchpoints

• Be cautious not to include RPCSS/* entries in the ProposedSpns, as these are auto-registered by AD CS.
• Verify that all necessary HTTP SPNs are present.

The New-AdcsSpnPlan command helps create a plan for registering SPNs with AD CS. This is useful when implementing DR 524, which requires manual registration of HTTP SPNs.

What Does It Do?

This command:

1. Takes a candidate from Get-AdcsSpnCandidate.
2. Resolves the CA server’s DistinguishedName.
3. Filters out RPCSS/* entries.
4. Outputs a plan with proposed HTTP SPNs.

Step-by-Step Recipes

To use this command, follow these steps:

1. Gather the necessary input for Get-AdcsSpnCandidate.
2. Pass the candidate to New-AdcsSpnPlan.
3. Review and manually register missing HTTP SPNs.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

The New-AdcsSpnPlan command handles data in accordance with AD CS security practices, ensuring that sensitive information remains secure during transit and at rest.

Data Handling

• Input: Candidates from Get-AdcsSpnCandidate.
• Processing: Resolves CA server’s DistinguishedName; filters out RPCSS/* entries.
• Output: Proposed HTTP SPNs for manual registration.

Transit

Data is securely transmitted over the network using standard Active Directory protocols.

At-Rest

Data is stored in accordance with AD CS security best practices, ensuring confidentiality and integrity.

Audit Trail

All operations performed by this command are logged within the AD CS infrastructure for audit purposes.