AD-SPN-09: User SPN unknown service class count should be investigated
| ID | AD-SPN-09 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Service principal names |
| Security area | Authentication |
| Resource type | User |
| MITRE ATT&CK | T1558.003 |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Unknown SPN service classes on user accounts require immediate attention because:
- High risk: User accounts with SPNs are Kerberoasting targets
- Shadow IT: Unknown services may bypass security controls
- Misconfigurations: Could indicate improper SPN registration
- Compliance issues: Unauthorized services violate security policies
User accounts are preferred targets for Kerberoasting, making unknown SPNs on these accounts particularly concerning.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Investigate all unknown SPNs on user accounts:
- Determine the service owner and business justification
- Verify if the service requires a user account or can use gMSA
- Check for misconfigurations or typos
- Remove unauthorized SPNs immediately
- Document approved custom SPNs
How the Test Works
Section titled “How the Test Works”This test compares discovered user SPN service classes against a database of known SPNs and flags any unrecognized service classes for investigation.
Related Tests
Section titled “Related Tests”Test-MtAdUserSpnUnknownDetails- Detailed information about unknown user SPNsTest-MtAdComputerSpnUnknownCount- Unknown SPNs on computer accountsTest-MtAdUserSpnServiceClassCount- All user SPN service classes
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.