Detent Point

SpnManager Kerberos SPN auditing and repair for Active Directory

Remove-SqlSpn

Removing stale Service Principal Names (SPNs) is a crucial task in maintaining the health of your Active Directory. This command helps ensure that only val...

Available today in SqlSpnManager

SQL Server is where this work started. Remove-SqlSpn ships in SqlSpnManager, on the PowerShell Gallery now — Install-Module SqlSpnManager. You can run it today.

SPN Manager takes the same approach across the rest of the directory, 26 service families in all. How the two products relate long term is not settled, and the free edition’s scope may narrow toward auditing in a future release. Any version you install stays yours — the Gallery keeps published versions available.

Removing stale Service Principal Names (SPNs) is a crucial task in maintaining the health of your Active Directory. This command helps ensure that only valid SPNs are registered with the plan’s account. A manager should be concerned when:

  • Stale SPNs cause authentication issues or errors.
  • A service identity change requires updates to existing SPNs.
  • Server decommissioning is not properly handled, leading to orphaned SPNs.

When a stale SPN is removed, it prevents potential security risks and ensures that only authorized services can access the plan’s account.

Day-to-Day Use

  1. Run Remove-SqlSpn with the required parameters:

    $plan | Remove-SqlSpn

  2. Verify the command’s output and audit log entries.

  3. Review the plan’s ProposedSpns list before executing Remove-SqlSpn to ensure only stale SPNs are removed.

Common Patterns

  • Use -WhatIf to preview the deregistration process without making changes: $plan | Remove-SqlSpn -WhatIf
  • Combine Remove-SqlSpn with other commands in a script for automated cleanup.

Code Examples

# Deregister all SPNs for the specified plan and account
Remove-SqlSpn -SpnPlan "my_plan" -SpnPlan "CN=account,OU=org"

# Preview deregistration without making changes
Remove-SqlSpn -SpnPlan "my_plan" -SpnPlan "CN=account,OU=org" -WhatIf

What Does it Do?

Remove-SqlSpn is a PowerShell command that helps clean up stale Service Principal Names (SPNs) associated with a plan’s account. It iterates through the plan’s ProposedSpns list and removes each SPN using setspn -D.

Step-by-Step Recipe

  1. Run Get-Help Remove-SqlSpn to understand the command parameters.
  2. Identify the plan and account for which you want to remove stale SPNs.
  3. Execute Remove-SqlSpn with the required parameters.

Getting Help When Stuck

  • Check the PowerShell module’s documentation for Remove-SqlSpn.
  • Consult online resources or forums for troubleshooting stale SPN issues.
  • Reach out to your organization’s Active Directory administrators for assistance.
Field Value
Vendor Detent Point LLC
Product SpnManager 0.4.0
Licence Proprietary - licensed, not sold. See LICENSE.
Operational impact CHANGES directory state. Registers or removes Service Principal Names on Active Directory accounts.
Rights required Directory read access.
Providers covered framework surface (not provider-specific)
Approval recommendation Approve for use by directory administrators, through change control. Preview with -WhatIf before any scheduled use.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

What Why
Windows PowerShell 5.1 or later Declared by the module manifest.
ActiveDirectory 1.0.0.0 Required module. Ships with RSAT; install the Active Directory PowerShell feature.
A reachable domain controller Every provider reads from Active Directory.
An account with directory read access Needed to enumerate accounts and their SPNs.
Rights to write servicePrincipalName Only for the write path. Audit and hand-off operations do not need it.

Removing stale Service Principal Names (SPNs) does not directly impact compliance with data-handling regulations, such as GDPR or HIPAA. However, ensuring only valid SPNs are registered helps maintain the integrity of your Active Directory.

  • Data-in-transit: The Remove-SqlSpn command does not transmit any sensitive data.
  • Data-at-rest: Removed SPNs are deleted from the plan’s account, adhering to best practices for minimizing sensitive information storage.
  • Audit Trail: The command writes a SUCCESS entry to the audit log upon successful deregistration, ensuring accountability.

This command changes Active Directory. Run it with -WhatIf first to see exactly which SPNs would be registered or removed.

Example 1

$plan | Remove-SqlSpn -WhatIf

Example 2

$plan | Remove-SqlSpn -Confirm:$false

Example 3

$spnPlan | Remove-SqlSpn