Detent PointThe New-ExchangeSpnPlan cmdlet is used to build a DR-524 SpnPlan from an Exchange SpnCandidate for HTTP SPN only. Business value: Automates the process of creating a SpnPlan for Exchange servers, reducing manual effort and potential errors. Who uses this: * Exchange administrators responsible for setting up and managing Exchange environments * System administrators responsible for ensuring proper configuration of Exchange servers Risks: * Incorrectly configured SpnPlans can lead to authentication issues and security vulnerabilities When a manager cares: When implementing or modifying an Exchange environment, or when troubleshooting authentication issues.
To use New-ExchangeSpnPlan:
- Get the Exchange SpnCandidate using Get-ExchangeSpnCandidate.
- Pass the candidate to New-ExchangeSpnPlan.
Get-ExchangeSpnCandidate -TargetComputer 'exch01.corp.example.com'
New-ExchangeSpnPlan -Candidate $candidateWatchpoints: * Ensure the correct candidate is passed to the cmdlet. * Verify that the HTTP SPN is correctly configured.
Here’s what New-ExchangeSpnPlan does in simple terms:
- Take an Exchange SpnCandidate from Get-ExchangeSpnCandidate.
- Filter out auto-registered entries (exchangeMDB/exchangeRFR/exchangeAB).
- Keep only the HTTP/
entry for manual registration.
Step-by-step recipe: * Run Get-ExchangeSpnCandidate to get a candidate. * Pass the candidate to New-ExchangeSpnPlan using the cmdlet. * Verify that the resulting SpnPlan is correctly configured.
What to do when stuck: Consult the module’s documentation or contact support.
| Field | Value |
|---|---|
| Vendor | Detent Point LLC |
| Product | SpnManager 0.4.0 |
| Licence | Proprietary - licensed, not sold. See LICENSE. |
| Operational impact | Read-only. Queries Active Directory and reports findings; changes nothing. |
| Rights required | Directory read access. |
| Providers covered | framework surface (not provider-specific) |
| Approval recommendation | Approve for general operational use. It cannot alter directory state. |
Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.
| What | Why |
|---|---|
| Windows PowerShell 5.1 or later | Declared by the module manifest. |
| ActiveDirectory 1.0.0.0 | Required module. Ships with RSAT; install the Active Directory PowerShell feature. |
| A reachable domain controller | Every provider reads from Active Directory. |
| An account with directory read access | Needed to enumerate accounts and their SPNs. |
New-ExchangeSpnPlan does not store or transmit sensitive data. Data-handling: * No sensitive data is stored or transmitted by the cmdlet. Transit: * The cmdlet only accesses Active Directory for resolving DistinguishedName, no data is transmitted. At-rest: * No data is stored persistently by the cmdlet. Audit trail: * The cmdlet logs its actions in the module’s audit log. Compliance requirements: * None specific to this cmdlet. However, ensure that Exchange and Active Directory configurations comply with relevant regulations and standards.
Example 1
Get-ExchangeSpnCandidate -MailNamespace 'mail.corp.example.com' | New-ExchangeSpnPlanAlso uses: Get-ExchangeSpnCandidate (Sense).
Example 2
New-ExchangeSpnPlan -Candidate $candidateExample 3
Get-ExchangeSpnCandidate -TargetComputer 'srv01' | New-ExchangeSpnPlan | Test-SpnPlanAlso uses: Get-ExchangeSpnCandidate (Sense), Test-SpnPlan (Test).