SpnManager Kerberos SPN auditing and repair for Active Directory

Test-SpnPlan

Test-SpnPlan is a critical component of the SpnManager module, ensuring that SpnPlans conform to the expected shape before execution. This validation step...

Test-SpnPlan is a critical component of the SpnManager module, ensuring that SpnPlans conform to the expected shape before execution. This validation step prevents errors and ensures successful deployment. Who uses this cmdlet? Administrators responsible for deploying and managing SpnPlans.

The key risks associated with Test-SpnPlan include:

  • Inadequate validation: Failure to identify invalid SpnPlans can lead to unexpected behavior or errors during execution.
  • Over-reliance on manual checks: Relying solely on manual verification of SpnPlans can be time-consuming and prone to human error.

A manager should care about Test-SpnPlan when:

  • Deploying new SpnPlans: Ensuring that SpnPlans conform to the expected shape before deployment is crucial.
  • Identifying issues: When errors or unexpected behavior occur during execution, a manager may need to investigate the cause and determine whether it was due to an invalid SpnPlan.

To use Test-SpnPlan in your daily work:

  1. Import the SpnManager module: Import-Module SpnManager
  2. Create or obtain a valid SpnPlan object.
  3. Call Test-SpnPlan with the SpnPlan object as input: Test-SpnPlan -SpnPlan $spnplan

The following code example demonstrates how to use Test-SpnPlan:

# Import the SpnManager module
Import-Module SpnManager

# Create a valid SpnPlan object
$spnplan = New-Object SpnPlan

# Call Test-SpnPlan with the SpnPlan object as input
$result = Test-SpnPlan -SpnPlan $spnplan

if ($result.Status -eq ‘Clear’) { Write-Host “The SpnPlan is valid.” } else { Write-Host “The SpnPlan is invalid: (result.Reason)” }

When using Test-SpnPlan, watch out for the following:

  • Ensure that the input SpnPlan object conforms to the expected shape.
  • Verify that the ProposedSpns array contains at least one element.

Test-SpnPlan validates the shape of a SpnPlan object before execution. This ensures that all required fields are present and that the ProposedSpns array is non-empty. To use Test-SpnPlan, follow these simple steps:

  1. Create or obtain a valid SpnPlan object.
  2. Call Test-SpnPlan with the SpnPlan object as input.

If you encounter issues during execution, check whether the SpnPlan object conforms to the expected shape by running Test-SpnPlan.

Field Value
Vendor Detent Point LLC
Product SpnManager 0.4.0
Licence Proprietary - licensed, not sold. See LICENSE.
Operational impact Read-only. Queries Active Directory and reports findings; changes nothing.
Rights required Directory read access. Some providers additionally need rights to read delegation and encryption-type attributes.
Providers covered SQL.SSAS, SQL.SSRS, AD.IIS, AD.ADFS, AD.SharePoint
Approval recommendation Approve for general operational use. It cannot alter directory state.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

What Why
Windows PowerShell 5.1 or later Declared by the module manifest.
ActiveDirectory 1.0.0.0 Required module. Ships with RSAT; install the Active Directory PowerShell feature.
A reachable domain controller Every provider reads from Active Directory.
An account with directory read access Needed to enumerate accounts and their SPNs.

Test-SpnPlan handles data in accordance with the following compliance requirements:

  • Data handling: Verifies required fields and ProposedSpns array are present.
  • Transit: No data transit occurs during execution of Test-SpnPlan.
  • At rest: The input SpnPlan object is stored in memory only.
  • Audit trail: No audit trail is generated by Test-SpnPlan.

Compliance requirements for Test-SpnPlan include:

  • Ensuring that the ProposedSpns array is non-empty to prevent invalid SpnPlans.

This is the test step. It checks a plan before anything acts on it. Its output is normally piped into Invoke-SpnExecutionEngine. Providers: AD.ADFS, AD.IIS, AD.SharePoint, SQL.SSAS, SQL.SSRS.

Example 1

$plan | Test-SpnPlan

Returns [PSCustomObject]@{ Status=‘Clear’; Reason=$null } when valid.

Example 2

Test-SpnPlan -SpnPlan $badPlan

Returns [PSCustomObject]@{ Status=‘Invalid’; Reason=‘Missing required field: PlanGuid’ } when a required field is absent.

Example 3

$plan | Test-SpnPlan