AD-SPN-10: User SPN unknown service class details should be investigated
| ID | AD-SPN-10 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Service principal names |
| Security area | Authentication |
| Resource type | User |
| MITRE ATT&CK | T1558.003 |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Detailed information about unknown user SPNs is critical for security:
- Immediate action required: User SPNs are prime Kerberoasting targets
- Accountability: Know exactly which users have unknown SPNs
- Investigation: Track down service owners quickly
- Risk assessment: Determine if high-privilege users have unknown SPNs
Unknown SPNs on privileged user accounts represent the highest risk.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”For each unknown user SPN:
- Contact the user or their manager to understand the service
- Verify if the service is legitimate and necessary
- If legitimate, document it and consider migrating to gMSA
- If unauthorized, remove the SPN immediately
- Check if the account has been compromised
How the Test Works
Section titled “How the Test Works”This test analyzes all user SPNs, identifies unknown service classes, and provides detailed information about which users have these SPNs.
Related Tests
Section titled “Related Tests”Test-MtAdUserSpnUnknownCount- Counts unknown service classes on usersTest-MtAdUserSpnDomainAdminDetails- Checks domain admin SPNs specificallyTest-MtAdComputerSpnUnknownDetails- Unknown computer SPN details
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.