Detent PointBusiness value: This command builds an SPN registration plan for SQL Server Reporting Services (SSRS), ensuring secure authentication with Active Directory. • Used by: IT administrators responsible for managing SSRS instances and their integrations with AD. • Risks: + Insecure SPNs can lead to unauthorized access or data breaches. + Failure to register SPNs can cause SSRS services to fail or behave unexpectedly. • A manager cares when: + An SSRS instance is being deployed or upgraded. + There are concerns about security or authentication with AD.
Day-to-day use: 1. Use Get-SsrsSpnCandidate to identify potential SPNs for an SSRS instance. 2. Pipe the candidate object to New-SsrsSpnPlan. 3. Inspect the generated plan for HTTP SPNs to register. 4. Apply the plan using the execution engine.
# Example usage:
$srsServiceAccount = 'SQLSvcDomain\Instance1'
$candidate = Get-SsrsSpnCandidate -TargetComputer $srsServiceAccountplan = New-SsrsSpnPlan -Candidate $candidate Write-Host “HTTP SPNs to register: (plan.ProposedSpns)”
Watchpoints: * Ensure the service account exists in AD and has a valid DistinguishedName. * Verify the SSRS instance is configured correctly for authentication with AD.
What it does: This command generates an SPN registration plan for SSRS, which ensures secure communication between the SSRS instance and Active Directory. The plan includes the necessary HTTP SPNs to register.
Step-by-step recipe: 1. Run Get-SsrsSpnCandidate on your service account. 2. Pipe the result to New-SsrsSpnPlan. 3. Review the generated plan for any issues or warnings.
What to do when stuck: * Check the documentation for Get-SsrsSpnCandidate and New-SsrsSpnPlan. * Consult with a colleague or IT administrator for assistance. * Verify that your service account exists in AD and has a valid DistinguishedName.
| Field | Value |
|---|---|
| Vendor | Detent Point LLC |
| Product | SpnManager 0.4.0 |
| Licence | Proprietary - licensed, not sold. See LICENSE. |
| Operational impact | Read-only. Queries Active Directory and reports findings; changes nothing. |
| Rights required | Directory read access. Some providers additionally need rights to read delegation and encryption-type attributes. |
| Providers covered | SQL.SSRS |
| Approval recommendation | Approve for general operational use. It cannot alter directory state. |
Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.
| What | Why |
|---|---|
| Windows PowerShell 5.1 or later | Declared by the module manifest. |
| ActiveDirectory 1.0.0.0 | Required module. Ships with RSAT; install the Active Directory PowerShell feature. |
| A reachable domain controller | Every provider reads from Active Directory. |
| An account with directory read access | Needed to enumerate accounts and their SPNs. |
Data-handling: The command does not store or transmit any sensitive data; it only reads AD records for service accounts. Transit: None, as the command operates within the local machine’s AD environment. At-rest: Data is stored in memory while processing, but none is persisted to disk. Audit trail: Generated plans are not audited by default, but can be logged using external tools or scripts. Compliance requirements: * Ensure service accounts exist in AD and have valid DistinguishedNames. * Register SPNs according to the generated plan to maintain secure authentication with AD.
This is the plan step. It turns a candidate into a plan showing what is missing; nothing is changed. Its output is normally piped into Test-SpnPlan. Providers: SQL.SSRS.
Example 1
Get-SsrsSpnCandidate | New-SsrsSpnPlanBuilds a plan from the locally detected SSRS candidate.
Also uses: Get-SsrsSpnCandidate (Sense).
Example 2
Get-SsrsSpnCandidate -ConfigPath 'D:\SSRS\ReportServer\rsreportserver.config' | New-SsrsSpnPlanBuilds a plan using an explicit config path for SSRS discovery.
Also uses: Get-SsrsSpnCandidate (Sense).
Example 3
New-SsrsSpnPlan -Candidate $candidate | Test-SpnPlanValidates a single plan without going through the candidate provider.
Also uses: Test-SpnPlan (Test).