AD-SPN-12 - No domain admin accounts should have SPNs configured

Contributed by Michael SouleAll contributors →

Overview

Domain administrator accounts with SPNs represent the highest possible Kerberoasting risk:

• Maximum privileges: Domain admins have unrestricted access to the entire domain
• Golden ticket risk: Compromising a domain admin can lead to complete domain compromise
• Service account misuse: Domain admin accounts should never be used as service accounts
• Password exposure: SPNs enable offline password cracking attempts

Zero domain admin accounts should have SPNs configured.

Control Type

Preventive

Security Recommendation

If domain admin accounts have SPNs:

• Immediate action: Remove all SPNs from domain admin accounts
• Investigate: Determine why SPNs were configured
• Migrate services: Move services to dedicated service accounts or gMSAs
• Audit: Review who has domain admin privileges
• Monitor: Implement alerts for SPN changes to privileged accounts

How the Test Works

This test identifies domain administrator accounts (using the well-known RID 500) and checks if they have any SPNs configured. Any SPNs found on these accounts are flagged as critical security risks.

Related Tests

• Test-MtAdUserSpnDomainAdminDetails - Detailed SPN information for domain admins
• Test-MtAdUserSpnTotalCount - Overall user SPN count
• Test-MtAdUserSpnServiceClassCount - Service classes on user accounts

Related links

• Microsoft Defender for Identity: Unsecure account attributes
• ANSSI Active Directory checkpoints: Privileged accounts with SPN

Test Metadata

Field	Value
Test ID	AD-SPN-12
Severity	Critical
Suite	Active Directory
Category	Active Directory - SPN Analysis
PowerShell test	Test-MtAdUserSpnDomainAdminCount
Services	ActiveDirectory
Tags	AD, AD-SPN-12, AD.SPN

Source

• Test: tests/ad/spn/Test.AD-SPN-12.ps1
• Documentation: tests/ad/spn/Test.AD-SPN-12.md