AD-FORS-03: SPN suffixes count should be retrievable


ID	`AD-FORS-03`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Domain and forest
Security area	Infrastructure hardening
Resource type	Tenant
Reads from	On-premises Active Directory

What this checks and how to fix it

SPN (Service Principal Name) suffixes simplify Service Principal Name management in complex Active Directory environments. They are important for:

Service Authentication: SPNs are used by Kerberos to authenticate services; suffixes provide flexibility in how services are registered
Multi-Domain Services: Organizations hosting services across multiple DNS namespaces use SPN suffixes to simplify SPN registration
Service Migration: SPN suffixes enable service migration between domains without changing service configurations
Security Assessment: Understanding SPN suffix configuration helps identify potential Kerberos authentication attack surfaces

Control Type

Operational

Security Recommendation

Review SPN suffix configuration regularly:

Ensure only legitimate organizational DNS domains are configured as SPN suffixes
Remove unused SPN suffixes that may have been added for completed projects
Verify that SPN suffixes align with the organization’s service hosting strategy
Monitor for unauthorized SPN suffix additions which could indicate compromise

How the Test Works

This test retrieves the SPN suffixes configured at the forest level using the Get-ADForest cmdlet. It counts the number of custom SPN suffixes and reports the configuration status. The default forest domain is available for SPN registration by default and is not counted as a custom suffix.

Test-MtAdUpnSuffixesCount - Checks UPN suffix configuration for user authentication
Test-MtAdUpnSuffixesDetails - Provides detailed UPN suffix information

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).