AD-SPN-11: User SPN non-FQDN hosts should be investigated


ID	`AD-SPN-11`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Service principal names
Security area	Authentication
Resource type	User
Reads from	On-premises Active Directory

What this checks and how to fix it

User account SPNs with non-FQDN hosts can cause:

Authentication failures: Kerberos may fail to resolve short names
Cross-domain issues: Non-FQDNs don’t work across domain trusts
Service disruptions: Applications may fail to authenticate
Configuration drift: Indicates inconsistent SPN management

Since user accounts with SPNs are already high-value targets, ensuring proper FQDN configuration is essential.

Control Type

Operational

Security Recommendation

Review and fix non-FQDN user SPNs:

Update SPNs to use fully qualified domain names
Establish SPN registration standards
Use FQDNs consistently for all service principal names
Consider this as part of a migration to gMSAs

How the Test Works

This test parses all user SPNs and checks if the host portion contains a dot (indicating FQDN format). SPNs without dots in the host portion are flagged as non-FQDN.

Test-MtAdComputerSpnNonFqdnHosts - Checks computer SPNs for non-FQDN hosts
Test-MtAdUserSpnTotalCount - Overall user SPN analysis

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).