New-SharePointSpnPlan

The New-SharePointSpnPlan cmdlet helps ensure that SharePoint service accounts are properly configured to maintain high availability and security. Business value:

• Ensures seamless failover in case of account or site issues
• Reduces risk of unauthorized access due to misconfigured SPNs
• Simplifies troubleshooting by providing a clear plan for SPN registration

Who uses this cmdlet: * SharePoint administrators responsible for ensuring high availability and security * IT professionals who manage Active Directory and service accounts

Risks:

• Failure to configure SPNs correctly can lead to downtime or unauthorized access
• Manual configuration of SPNs can be time-consuming and prone to errors

When a manager cares:

• When experiencing issues with SharePoint availability or security
• When implementing new SharePoint deployments or upgrades
• When reviewing IT policies for compliance with security best practices

To use the New-SharePointSpnPlan cmdlet, follow these steps: 1. Run Get-SharePointSpnCandidate to retrieve a list of potential service account candidates. 2. Select one candidate using the -Candidate parameter and pipe it to the New-SharePointSpnPlan cmdlet. 3. The cmdlet will resolve the service account’s DistinguishedName from Active Directory using Get-ADObject. 4. Output will be a DR-524 SpnPlan describing the HTTP SPNs to register.

Example code:

$candidates = Get-SharePointSpnCandidate
$candidate = $candidates | Where-Object { $_.Account -eq "MyAppPoolAccount" }
$spnPlan = New-SharePointSpnPlan -Candidate $candidate

Watchpoints:

• Ensure the -Candidate parameter is set correctly to avoid incorrect SPN registration.
• Verify that Active Directory access is configured properly for Get-ADObject.

The New-SharePointSpnPlan cmdlet takes a SharePoint service account candidate and generates a plan for registering HTTP SPNs.

1. What is the purpose of this cmdlet?
   • To ensure high availability and security in SharePoint by configuring correct SPNs.
2. What does it do with a candidate?
   • Resolves the DistinguishedName from Active Directory using Get-ADObject.
3. What output can you expect?
   • A DR-524 SpnPlan describing HTTP SPNs to register.

If stuck: * Check the -Candidate parameter is set correctly. * Verify Active Directory access for Get-ADObject.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

The New-SharePointSpnPlan cmdlet handles data as follows:

• In-transit: Uses secure connections (dependent on module dependencies)
• At-rest: Data is stored securely in accordance with Active Directory access controls
• Audit trail: Output plan is logged and can be used for auditing purposes

Compliance requirements:

• SharePoint administrators must ensure SPNs are correctly configured to meet security and availability requirements.
• IT professionals must verify that Active Directory access meets compliance standards.