New-PrintSpnAuditPlan

The New-PrintSpnAuditPlan command from the SpnManager module provides a comprehensive way to identify potential security risks in Active Directory (AD) by comparing expected HOST/RPCSS Service Principal Names (SPNs) against those stored in the AD machine account. This process helps ensure that services are properly registered with AD, reducing the risk of unexpected behavior or unauthorized access.

Key benefits:

• Identifies missing and orphaned SPNs
• Reduces security risks by ensuring accurate service registration
• Can be used to enforce compliance with organizational security policies

Managers should care about this command when: * Migrating services between machines or domains * Integrating with other security tools or processes * Addressing security vulnerabilities or incidents

To use New-PrintSpnAuditPlan, follow these steps:

1. Import the SpnManager module using Import-Module
2. Create a candidate object by specifying the cluster computer’s sAMAccountName in the Candidate parameter, like this: $candidate = Get-ClusterComputer -Name "ClusterName" | Select-Object sAMAccountName
3. Run the command with the candidate object as an argument: New-PrintSpnAuditPlan -Candidate $candidate

Example output:

MissingSPNs          : {HOST/Machine1, RPCSS/Machine2}
OrphanedSPNs        : {RPCSS/Service1, HOST/Service2}

Watchpoints:

• Ensure the SpnManager module is up-to-date and installed correctly
• Use the ClusterVNN parameter to specify the cluster computer’s sAMAccountName

Common patterns: * Run the command periodically as part of a scheduled task or script * Integrate with other security tools or processes to automate remediation tasks

Here’s what you need to know about New-PrintSpnAuditPlan:

What it does: Compares expected HOST/RPCSS SPNs against those stored in the AD machine account, identifying missing and orphaned SPNs.

Step-by-step:

1. Import the SpnManager module.
2. Create a candidate object using Get-ClusterComputer or another method.
3. Run New-PrintSpnAuditPlan with the candidate object as an argument.

What to do when stuck: Consult the documentation, check for software updates, and seek assistance from a support team if needed.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

The New-PrintSpnAuditPlan command handles data as follows:

• Data in transit: No sensitive information is transmitted between systems.
• Data at rest: Only expected and actual SPNs are stored, reducing the risk of unauthorized access or exposure.
• Audit trail: The command logs its output to the console, allowing for auditing and compliance tracking.

Compliance requirements:

• Follow organizational security policies and procedures
• Regularly review and update expected SPNs in AD
• Run the New-PrintSpnAuditPlan command periodically to identify potential security risks.