The Test-SpnAuditPlan cmdlet is a crucial component of the SpnManager module, ensuring that the shape of the SpnAuditPlan is valid before it’s handed off for processing. This function is primarily used by security and audit teams to validate the integrity of their plans.
- Key benefits:
- Ensures compliance with requirements (DR-510)
- Prevents errors due to missing or malformed data
- Streamlines the audit process by reducing manual checks
- Risks:
- Failure to validate plan shape may lead to incorrect results or delays in processing
- Inadequate testing may result in non-compliance or security vulnerabilities
- When a manager cares:
- During planning and implementation phases, when configuring the SpnAuditPlan
- After making changes to the plan or its configuration
To use Test-SpnAuditPlan, follow these steps:
- Load the SpnManager module:
Import-Module -Name SpnManager - Create an instance of the
SpnAuditPlanobject:$plan = New-Object -TypeName SpnAuditPlan - Configure the plan with required fields and data
- Run the validation cmdlet:
Test-SpnAuditPlan -Plan $plan
Example code:
$plan = New-Object -TypeName SpnAuditPlan
$plan.RequiredFields = @("Field1", "Field2")
$plan.ExpectedSpns = @("spn1", "spn2")
$result = Test-SpnAuditPlan -SpnPlan $planif ($result.IsValid) { Write-Host “Plan is valid” } else { Write-Host “Plan is invalid: (result.Errors)” } Watchpoints:
- Ensure the plan has all required fields populated
- Verify that the
ExpectedSpnsarray is not empty - Handle errors and exceptions properly
The Test-SpnAuditPlan cmdlet checks if a given SpnAuditPlan meets certain conditions before it’s processed. Here’s how to use it in simple terms:
- Load the SpnManager module.
- Create an instance of the
SpnAuditPlanobject. - Add required fields and data to the plan.
- Run the validation cmdlet with the plan as input.
What to do when stuck:
- Check if all required fields are populated in the plan.
- Verify that the
ExpectedSpnsarray is not empty. - Consult the SpnManager documentation or support resources for further assistance.
| Field | Value |
|---|---|
| Vendor | Detent Point LLC |
| Product | SpnManager 0.4.0 |
| Licence | Proprietary - licensed, not sold. See LICENSE. |
| Operational impact | Read-only. Queries Active Directory and reports findings; changes nothing. |
| Rights required | Directory read access. Some providers additionally need rights to read delegation and encryption-type attributes. |
| Providers covered | AD.RDP, AD.SMB, AD.WinRM, AD.DNS, AD.PrintSpooler, AD.Exchange, AD.ADCS, AD.DFS |
| Approval recommendation | Approve for general operational use. It cannot alter directory state. |
Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.
| What | Why |
|---|---|
| Windows PowerShell 5.1 or later | Declared by the module manifest. |
| ActiveDirectory 1.0.0.0 | Required module. Ships with RSAT; install the Active Directory PowerShell feature. |
| A reachable domain controller | Every provider reads from Active Directory. |
| An account with directory read access | Needed to enumerate accounts and their SPNs. |
The Test-SpnAuditPlan cmdlet handles data in accordance with the following compliance requirements:
- Data Handling: Validates plan shape, ensuring only compliant plans are processed.
- Transit: No sensitive data is transmitted or stored during validation.
- At-Rest: Plan data is stored securely and not accessible to unauthorized users.
- Audit Trail: All errors and exceptions are logged and tracked for auditing purposes.
This is the test step. It checks a plan before anything acts on it. Providers: AD.ADCS, AD.DFS, AD.DNS, AD.Exchange, AD.PrintSpooler, AD.RDP, AD.SMB, AD.WinRM.
Example 1
$plan | Test-SpnAuditPlanExample 2
$result = Test-SpnAuditPlan -SpnPlan $planif ($result.Status -ne ‘Clear’) { Write-Error $result.Reason }
Example 3
$plan | Test-SpnAuditPlan