AD-SPN-12: No domain admin accounts should have SPNs configured


ID	`AD-SPN-12`
Severity	Critical
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Service principal names
Security area	Privileged access
Resource type	User
User impact of fixing	Low
Effort to fix	Medium
Framework controls	`nist-800-53-r5:AC-6(5)` Least Privilege \| Privileged Accounts `nist-800-53-r5:IA-5` Authenticator Management
MITRE ATT&CK	T1558.003
Reads from	On-premises Active Directory

What this checks and how to fix it

Domain administrator accounts with SPNs represent the highest possible Kerberoasting risk:

Maximum privileges: Domain admins have unrestricted access to the entire domain
Golden ticket risk: Compromising a domain admin can lead to complete domain compromise
Service account misuse: Domain admin accounts should never be used as service accounts
Password exposure: SPNs enable offline password cracking attempts

Zero domain admin accounts should have SPNs configured.

Control Type

Preventive

Security Recommendation

If domain admin accounts have SPNs:

Immediate action: Remove all SPNs from domain admin accounts
Investigate: Determine why SPNs were configured
Migrate services: Move services to dedicated service accounts or gMSAs
Audit: Review who has domain admin privileges
Monitor: Implement alerts for SPN changes to privileged accounts

How the Test Works

This test identifies domain administrator accounts (using the well-known RID 500) and checks if they have any SPNs configured. Any SPNs found on these accounts are flagged as critical security risks.

Test-MtAdUserSpnDomainAdminDetails - Detailed SPN information for domain admins
Test-MtAdUserSpnTotalCount - Overall user SPN count
Test-MtAdUserSpnServiceClassCount - Service classes on user accounts

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).