Detent PointThe New-DnsSpnAuditPlan command is used to identify potential DNS SPN issues on a machine account in Active Directory (AD). This is particularly useful when dealing with server renames or changes in DNS records.
- Who uses this: AD administrators, security teams, and IT operations personnel
- Business value:
- Ensures correct DNS SPNs are present for Kerberos authentication
- Helps identify potential security risks due to orphaned or missing SPNs
- Risks:
- Inaccurate or outdated DNS records can lead to authentication issues
- Failure to detect missing or orphaned SPNs can expose the organization to security threats
- When a manager cares: This command is essential for maintaining AD health and security, especially in large-scale environments.
- Preparation: Ensure you have necessary permissions to read AD attributes.
- Execution:
$candidate = Get-DnsSpnCandidate -TargetComputer 'dc01.corp.example.com'
New-DnsSpnAuditPlan -Candidate $candidateThis will output the audit plan results.
- Common patterns: Use this command as part of regular AD maintenance and security checks.
- Watchpoints:
- Monitor for missing or orphaned SPNs in DNS records.
- Verify that all DNS SPNs match the machine account’s ServicePrincipalName attribute.
The New-DnsSpnAuditPlan command helps identify potential issues with DNS Service Principal Names (SPNs) on a machine account. It does this by:
- Reading the machine account’s ServicePrincipalName attribute from AD.
- Filtering to only include DNS/* entries.
- Computing missing and orphaned SPNs.
If you’re unsure about anything, try running Get-Help New-DnsSpnAuditPlan for more information!
| Field | Value |
|---|---|
| Vendor | Detent Point LLC |
| Product | SpnManager 0.4.0 |
| Licence | Proprietary - licensed, not sold. See LICENSE. |
| Operational impact | Read-only. Queries Active Directory and reports findings; changes nothing. |
| Rights required | Directory read access. Some providers additionally need rights to read delegation and encryption-type attributes. |
| Providers covered | AD.DNS |
| Approval recommendation | Approve for general operational use. It cannot alter directory state. |
Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.
| What | Why |
|---|---|
| Windows PowerShell 5.1 or later | Declared by the module manifest. |
| ActiveDirectory 1.0.0.0 | Required module. Ships with RSAT; install the Active Directory PowerShell feature. |
| A reachable domain controller | Every provider reads from Active Directory. |
| An account with directory read access | Needed to enumerate accounts and their SPNs. |
- Data handling: This command only reads from AD and does not modify any data.
- Transit: All data is transmitted securely using standard AD protocols.
- At rest: Data is stored in AD, subject to organization’s existing security policies.
- Audit trail: Results are output to the console; consider logging for further audit requirements.
This is the plan step. It turns a candidate into a plan showing what is missing; nothing is changed. Its output is normally piped into Test-SpnAuditPlan. Providers: AD.DNS.
Example 1
Get-DnsSpnCandidate -TargetComputer 'dc01' | New-DnsSpnAuditPlanAlso uses: Get-DnsSpnCandidate (Sense).
Example 2
New-DnsSpnAuditPlan -Candidate $candidateExample 3
Get-DnsSpnCandidate -TargetComputer 'srv01' | New-DnsSpnAuditPlan | Test-SpnAuditPlanAlso uses: Get-DnsSpnCandidate (Sense), Test-SpnAuditPlan (Test).