AD-USER-14: User SPN count should be retrievable
| ID | AD-USER-14 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Service principal names |
| Security area | Authentication |
| Resource type | User |
| MITRE ATT&CK | T1558.003 |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”User accounts with ServicePrincipalName values are typically used as service accounts. These accounts are important because they may be susceptible to Kerberoasting and often have broad or persistent access.
- Kerberoasting exposure: User SPNs are a common attack target
- Service account discovery: Helps inventory service identities in the domain
- Hardening priority: Supports review of password hygiene, delegation, and logon restrictions
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Review every user account with an SPN and confirm it is a legitimate service account
- Prefer managed service account options where possible
- Ensure service accounts use strong credential and monitoring controls
How the Test Works
Section titled “How the Test Works”This test counts user objects where the ServicePrincipalName attribute contains one or more values.
Related Tests
Section titled “Related Tests”Test-MtAdUserKnownServiceAccountCount- Identifies service accounts by naming conventionTest-MtAdUserAdminCountCount- Highlights protected user accounts that may need extra scrutiny
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.