List all SPNs used in your Active Directory

1. J

   14/12/2023, 19:43

   Get-ADObject -Filter ‘servicePrincipalName -like “*”‘ -Properties servicePrincipalName

2. Pingback: Windows SID to username and vice versa

3. Philippe

   28/04/2021, 16:50

   A few enhancement:

   class Spn {
       static [int]$counter
       [int]$id
       [string]$serviceClass
       [string]$name
       [string]$spnChain 
   
       Spn([string]$spnChainIs){
           
           $this.id = [Spn]::counter++
           $this.spnChain = $spnChainIs
           $temp = $spnChainIs.Split("/")
           $this.serviceClass = $temp[0]
           $this.name = $temp[1]
           
       }
   
       Spn([string]$portIs,[string]$objectIs){
           
           $this.id = [Spn]::counter++
           $this.serviceClass = $portIs
           $this.name = $objectIs
           $this.spnChain = ($this.serviceClass + "/" + $this.name)
       }
   
       [string] ToString(){
           return ("$($this.spnChain)")
       }
   
   }
   
   class Spns {
       hidden[string]$objectCategory
       hidden[string]$dN
       [string]$name
       [Spn[]]$spnss
   
   }
   
   Clear-Host
   $search = New-Object DirectoryServices.DirectorySearcher([ADSI]"")
   $search.filter = "(servicePrincipalName=*)"
   
   ## You can use this to filter for OU's:
   ## $results = $search.Findall() | ?{ $_.path -like '*OU=whatever,DC=whatever,DC=whatever*' }
   $results = $search.Findall()
   
   $report = @()
   
   foreach( $result in $results ) {
   	$userEntry = $result.GetDirectoryEntry()
       [Spns]$userSPNs = [Spns]::new()
       $userSPNs.dN             = $userEntry.distinguishedName
       $userSPNs.name           = $userEntry.name
       $userSPNs.objectCategory = $userEntry.objectCategory
   
       [Spn]::counter = 0
   	foreach( $SPN in $userEntry.servicePrincipalName ) {
           [Spn]$oneSpn = [Spn]::new($SPN)
           $userSPNs.spnss += $oneSpn #.ToString()
   	}
       $report += $userSPNs
   }
   
   $report | Measure-Object
   $report | Where-Object {($_.spnss).spnChain -like "*changepw*"}

   • A Jan Reilink

     29/04/2021, 10:14

     Great addition Philippe, thank you!

4. Purclot

   05/04/2021, 12:26

   if the tusk is just to list all the SPNs in your domain, why just not simply:
   Get-ADUser -filter * -prop * | where{$_.serviceprincipalname -ne $null} | select name, serviceprincipalname
   ?

   • A Jan Reilink

     06/04/2021, 09:21

     Thank you for your addition Purclot, thank you. It’s always great to have multiple methods available. Or use Get-ADComputer .

5. John Sullivan

   24/09/2020, 18:58

   How can the above PowerShell script be modified to show just one server? I have tried different things but cannot get it to work.

   Thanks

6. FrankJ

   20/09/2019, 21:00

   If using dsquery this filter will return user and computer objects
   -filter “(&(|(objectcategory=computer)(objectcategory=user))(servicePrincipalName=*))”

   • A Jan Reilink

     20/09/2019, 22:19

     Thanks for your addition FrankJ!

7. John Doe

   07/12/2018, 21:54

   it is better to

   setspn -Q */*

   • A Jan Reilink

     07/12/2018, 22:09

     Thanks for your addition!

     Update, a note to “John Doe’s” -Q addition: it seems like the -Q query modifier is removed in Windows Server 2016 and up. It’s available in the help of my Windows Server 2012 R2 servers, but not in 2016:

     d:\deployment>setspn /?
     Usage: setspn [switches data] computername
       Where "computername" can be the name or domain\name
     
       Switches:
        -R = reset HOST ServicePrincipalName
         Usage:   setspn -R computername
        -A = add arbitrary SPN
         Usage:   setspn -A SPN computername
        -D = delete arbitrary SPN
         Usage:   setspn -D SPN computername
        -L = list registered SPNs
         Usage:   setspn [-L] computername
     Examples:
     setspn -R daserver1
        It will register SPN "HOST/daserver1" and "HOST/{DNS of daserver1}"
     setspn -A http/daserver daserver1
        It will register SPN "http/daserver" for computer "daserver1"
     setspn -D http/daserver daserver1
        It will delete SPN "http/daserver" for computer "daserver1"

8. Jan

   09/04/2018, 09:31

   Hé this is a great way to list all SPN’s used in my active directory network, thanks!

Comments are closed