AD-SPN-13: No domain admin accounts should have SPNs configured


ID	`AD-SPN-13`
Severity	Critical
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Service principal names
Security area	Privileged access
Resource type	User
User impact of fixing	Low
Effort to fix	Medium
Framework controls	`nist-800-53-r5:AC-6(5)` Least Privilege \| Privileged Accounts `nist-800-53-r5:IA-5` Authenticator Management
MITRE ATT&CK	T1558.003
Reads from	On-premises Active Directory

What this checks and how to fix it

Detailed visibility into domain admin SPNs is critical for security incident response:

Immediate remediation: Know exactly which SPNs to remove
Service identification: Understand what services were improperly configured
Attack surface assessment: Evaluate the scope of exposure
Compliance violation: Domain admins should never have SPNs

Any SPN on a domain admin account is a critical finding requiring immediate action.

Control Type

Preventive

Security Recommendation

Immediate actions required:

Remove ALL SPNs from domain administrator accounts
Investigate how and why SPNs were configured
Create dedicated service accounts or gMSAs for the services
Review domain admin membership and remove unnecessary accounts
Implement monitoring for SPN changes to privileged accounts
Consider this a potential security incident requiring investigation

How the Test Works

This test identifies domain administrator accounts and provides detailed information about any SPNs configured on them, including service class, host, FQDN status, and full SPN value for remediation.

Test-MtAdUserSpnDomainAdminCount - Counts SPNs on domain admins
Test-MtAdUserSpnTotalCount - Overall user SPN analysis
Test-MtAdUserSpnUnknownDetails - Unknown SPN details on all users

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).