New-IisSpnPlan

As a manager, it’s essential to understand the business value of using New-IisSpnPlan from the SpnManager module. This command helps ensure that IIS app pool accounts have valid SPNs (Service Principal Names) registered in Active Directory, which is crucial for secure authentication and authorization.

• Who uses this: IT administrators responsible for IIS configuration and security.
• Risks:
  • Failure to register valid SPNs can lead to authentication issues and security vulnerabilities.
  • Inaccurate or incomplete SPN plans can cause service disruptions.
• When a manager cares:
  • When implementing new IIS configurations or migrating existing ones.
  • During security audits or compliance checks.

To use New-IisSpnPlan, follow these steps:

1. Retrieve an SpnCandidate object using Get-IisSpnCandidate.
2. Resolve the app pool service account’s Distinguished Name from Active Directory using Get-ADObject.
3. Pass the SpnCandidate and AD result to New-IisSpnPlan to build a fully-populated SpnPlan object.

$spnCandidate = Get-IisSpnCandidate -TargetComputer 'MyAppPool'
$result = New-IisSpnPlan -Candidate $spnCandidate -Candidate (Get-ADObject -Filter 'Name -eq "CN=MyServiceAccount"')
$spnPlan = $result.SpnPlan

Watchpoints:

• Ensure the SpnCandidate object has valid ExpectedSpns.
• Verify that the AD result contains the correct Distinguished Name.

New-IisSpnPlan builds an SPN plan for an IIS app pool account candidate. To use this command, you need to:

1. Get an SpnCandidate object using Get-IisSpnCandidate.
2. Resolve the AD result containing the app pool service account’s Distinguished Name.
3. Pass these inputs to New-IisSpnPlan to get a fully-populated SpnPlan object.

If you’re stuck, check:

• If your SpnCandidate object has valid ExpectedSpns.
• If your AD result contains the correct Distinguished Name.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

This command handles sensitive data (AD credentials and SPNs) securely:

• Transit: Data is encrypted in transit using secure protocols.
• At Rest: Data is stored securely, following best practices for password management.
• Audit Trail: All interactions with AD are logged and audited.
• Compliance Requirements:
  • Meets or exceeds applicable regulations for data handling (e.g., GDPR, HIPAA).