New-SsasSpnPlan

Business value: This command is crucial for building a secure Service Principal Name (SPN) plan for SQL Server Analysis Services candidates, ensuring compliance with DR-524. Who uses this: IT administrators responsible for implementing and managing SPNs in their organization’s Active Directory. Risks: Failure to properly build an SPN plan can lead to security vulnerabilities and unauthorized access to Analysis Services instances. Managers should ensure that the correct procedure is followed when building the SPN plan. When a manager cares: * When introducing new Analysis Services instances into the environment * When reviewing and updating existing SPN plans for compliance with DR-524

Day-to-day use:

1. Run Get-SsasSpnCandidate to identify potential candidates for an SPN plan.
2. Pipe the output of Get-SsasSpnCandidate into New-SsasSpnPlan to build a fully-populated SpnPlan object.
3. Examine the returned SpnPlan object to verify that it meets the DR-524 schema requirements.

Common patterns:

• Building an SPN plan for a single Analysis Services instance
• Updating existing SPN plans with new service account information

Code examples:

$spnCandidates = Get-SsasSpnCandidate -TargetComputer "MyAnalysisServices"
$spsnPlan = New-SsasSpnPlan -Candidate $spnCandidates

Watchpoints:

• Ensure that the input object for New-SsasSpnPlan is a valid SpnCandidate object.
• Verify that the returned SpnPlan object meets the DR-524 schema requirements.

What this does: This command builds an SPN plan (DR-524) for a SQL Server Analysis Services candidate by accepting an SpnCandidate object and resolving the service account’s Distinguished Name from Active Directory. Step-by-step recipe:

1. Run Get-SsasSpnCandidate to identify potential candidates for an SPN plan.
2. Pipe the output of Get-SsasSpnCandidate into New-SsasSpnPlan to build a fully-populated SpnPlan object.
3. Examine the returned SpnPlan object to verify that it meets the DR-524 schema requirements.

What to do when stuck:

• Check the input object for errors or inconsistencies.
• Verify that the service account’s Distinguished Name is correctly resolved from Active Directory.
• Consult the module documentation or seek assistance from an experienced IT administrator.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

Data handling: This command handles sensitive information, including service account Distinguished Names and SPNs. Transit: Data is transmitted over the local network during execution. At rest: Data is stored in memory temporarily while building the SpnPlan object. Audit trail: This command generates no audit trail entries, as it only builds an SPN plan without making any changes to AD or SPNs. Compliance requirements:

• DR-524 schema must be followed for all Analysis Services instances.
• Service account Distinguished Names and SPNs must be securely stored.