AD-SPN-07: User SPN service class count should be investigated
| ID | AD-SPN-07 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Service principal names |
| Security area | Authentication |
| Resource type | User |
| MITRE ATT&CK | T1558.003 |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Understanding the service classes of SPNs on user accounts helps security teams:
- Identify service types: Know what services are running under user credentials
- Assess risk: Some service classes (like MSSQLSvc) are higher-value targets
- Detect anomalies: Unexpected service classes may indicate unauthorized services
- Plan migrations: Identify candidates for migration to gMSAs
User accounts with database or application service SPNs are particularly sensitive.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Review service classes on user accounts:
- Database services (MSSQLSvc, oracle, postgres) should use gMSAs
- Web services (HTTP, HTTPS) should run under service accounts or gMSAs
- Legacy service classes may indicate outdated applications
- Document all user accounts with SPNs and their purposes
How the Test Works
Section titled “How the Test Works”This test retrieves all user objects with SPNs, extracts the service class from each SPN, and counts the distinct service classes in use.
Related Tests
Section titled “Related Tests”Test-MtAdUserSpnServiceClassUsage- Detailed breakdown of service class usageTest-MtAdUserSpnTotalCount- Total count of user SPNsTest-MtAdComputerSpnServiceClassCount- Computer account service classes
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.