Detent Point

SpnManager Kerberos SPN auditing and repair for Active Directory

New-SqlSpnPlan

SpnManager command reference for New-SqlSpnPlan.

Available today in SqlSpnManager

SQL Server is where this work started. New-SqlSpnPlan ships in SqlSpnManager, on the PowerShell Gallery now — Install-Module SqlSpnManager. You can run it today.

SPN Manager takes the same approach across the rest of the directory, 26 service families in all. How the two products relate long term is not settled, and the free edition’s scope may narrow toward auditing in a future release. Any version you install stays yours — the Gallery keeps published versions available.

  • As a manager, you care when using New-SqlSpnPlan because it ensures correct SPN registration for your SQL Server infrastructure.
  • Risks include incorrect or missing SPNs, which can cause authentication issues or prevent services from starting.
  • This command is used by anyone responsible for managing the infrastructure and security of their SQL Server environment.
  1. Step 1: Gather required information:
    • Verify the account DN and ensure it has the necessary permissions to create SPNs.
    • Resolve the target domain, which may involve resolving a FQDN or verifying that the domain is in sync with your local AD.
  2. Step 2: Create the plan object:
$account = Get-SqlSpnAccount -SamAccountName 'svc_sql_prod'
$infra   = Get-SqlSpnInfrastructure -Scenario Standalone -TargetName 'sqlsrv01'
New-SqlSpnPlan -VerifiedAccount $account -Infrastructure $infra -Role Engine
  1. Step 3: Review the plan object:
    • Verify that the PlanGuid and AccountDn are correctly populated.
    • Check that the proposed SPNs match your expected values.

What does New-SqlSpnPlan do?

  • This command creates a plan for registering Service Principal Names (SPNs) with the AD, which allows services like SQL Server to authenticate and communicate securely.
  • It uses information about the account, infrastructure, and role to create a canonical plan object.

How to use New-SqlSpnPlan:

  1. Step 1: Understand your environment:
    • Familiarize yourself with the AD structure and permissions.
    • Verify that you have the necessary credentials to run this command.
  2. Step 2: Gather required information:
    • Identify the account DN, resolved infrastructure, and role for which you’re creating the plan.
  3. Step 3: Run the command:
New-SqlSpnPlan -VerifiedAccount $account -Infrastructure $infra -Role Agent

What to do when stuck:

  • Step 1: Review the documentation:
    • Check if there are any specific requirements or considerations for your role and environment.
  • Step 2: Verify the inputs:
    • Double-check that you’ve provided the correct account DN, resolved infrastructure, and role.
Field Value
Vendor Detent Point LLC
Product SpnManager 0.4.0
Licence Proprietary - licensed, not sold. See LICENSE.
Operational impact Read-only. Queries Active Directory and reports findings; changes nothing.
Rights required Directory read access. Some providers additionally need rights to read delegation and encryption-type attributes.
Providers covered SQL.Engine
Approval recommendation Approve for general operational use. It cannot alter directory state.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

What Why
Windows PowerShell 5.1 or later Declared by the module manifest.
ActiveDirectory 1.0.0.0 Required module. Ships with RSAT; install the Active Directory PowerShell feature.
A reachable domain controller Every provider reads from Active Directory.
An account with directory read access Needed to enumerate accounts and their SPNs.

Data-handling compliance considerations:

  • Transit: When registering SPNs, this command transmits account information and infrastructure details over the network.
  • At-rest: The plan object and registered SPNs are stored securely within the AD.

Audit trail:

  • This command logs all plan creations and modifications in the module’s audit log.

Compliance requirements:

  • Adhere to your organization’s security policies for managing account information and infrastructure details.

This is the plan step. It turns a candidate into a plan showing what is missing; nothing is changed. Its output is normally piped into Test-SqlSpnPlan. Providers: SQL.Engine.

Example 1

$acct  = Get-SqlSpnAccount -SamAccountName 'svc_sql_prod'
$infra = Get-SqlSpnInfrastructure -Scenario Standalone -TargetName SQLSRV01
$plan  = New-SqlSpnPlan -VerifiedAccount $acct -Infrastructure $infra -Role Engine

Example 2

# FCI: VerifiedAccount is the SQL service's domain account (e.g. svc_sql_fci),
# never the cluster's virtual computer object (DR-558 / SqlSpnManager DR-313).
$acct  = Get-SqlSpnAccount -SamAccountName 'svc_sql_fci'
$infra = Get-SqlSpnInfrastructure -Scenario FCI -TargetName SQLFCI01
$plan  = New-SqlSpnPlan -VerifiedAccount $acct -Infrastructure $infra -Role Engine

Example 3

# SSAS named instance: colon suffix carries the instance name, never a port.
$acct  = Get-SqlSpnAccount -SamAccountName 'svc_ssas'
$infra = Get-SqlSpnInfrastructure -Scenario Standalone -TargetName OLAP01
$plan  = New-SqlSpnPlan -VerifiedAccount $acct -Infrastructure $infra -Role SSAS