Six audits that read AD and change nothing.
The audit providers are a product in their own right. Each one reads attributes, applies a documented rule, and reports. None of them writes. Together they cover the failure classes a security or compliance reader asks about first: delegation in three forms, duplicates, encryption types, and keytab drift.
Unconstrained delegation
Unconstrained delegation is the highest-risk configuration in the set and should be eliminated in modern environments. The audit lists every holder so the conversation can be about which ones, not whether.
- reads
- Every user and computer object with
TrustedForDelegation = true. - flags
- Any service account with unconstrained delegation. Any server that can impersonate any user to any service is a pivot target.
Kerberos constrained delegation
A delegation entry that references an unregistered SPN fails silently and intermittently. This audit finds the broken reference before the double-hop fails in production.
- reads
- Every
msDS-AllowedToDelegateToentry, cross-checked against the SPNs actually registered in AD. - flags
- Delegation targets that name an SPN no account holds. Targets pointing at decommissioned servers.
Resource-based constrained delegation
RBCD inverts the KCD model: the resource decides who may delegate to it. Windows Admin Center, Azure Arc, and AD-joined Kubernetes clusters use it, and the grants are rarely reviewed.
- reads
- Every computer object with
msDS-AllowedToActOnBehalfOfOtherIdentity; parses the security descriptor and resolves the allowed principals. - flags
- Overly broad grants (for example, all domain computers). Orphaned raw-SID grants, flagged High. Stale entries after the delegating service was decommissioned.
Forest-wide duplicate SPN scan
Slow on large forests by nature, and the audit says so up front. Duplicates are the failure that is invisible from either account on its own.
- reads
- Wraps
setspn -Xorsetspn -F -Xfor explicit forest scope and parses the output into typed duplicate records. - flags
- The same SPN on two accounts, which yields
KRB_ERR_S_PRINCIPAL_UNKNOWN. Service-account migrations and machine renames are the usual sources.
Kerberos encryption types
The RC4-versus-AES mismatch is the most common breaker since November 2022. The audit stays inside AD data: it cannot claim the negotiated etype, and does not.
- reads
- Per account:
msDS-SupportedEncryptionTypes,userAccountControl(USE_DES_KEY_ONLY),pwdLastSet, Protected Users membership. Decodes the [MS-KILE] bit flags and applies the KB5021131 unset-attribute semantics. - flags
- Attribute unset (the DC assumes 0x27 or the domain default, not AES). Explicit RC4-only against an AES-only policy. AES enabled but the password never reset afterwards, so no AES keys exist. Accounts in Protected Users.
Keytab enctype / KVNO drift
Findings are labelled possible, never confirmed. Confirming skew requires reading the keytab on the host, which this product does not do. The runbook it emits tells the host owner what to check.
- reads
- Keytab-bearing accounts forest-wide (user objects carrying an SPN).
msDS-SupportedEncryptionTypes,msDS-KeyVersionNumberwhere readable,pwdLastSet. - flags
- Possible skew, from two AD-side signals: a recent password reset, and a legacy-only enc-type posture. Both signals together are the highest-confidence subset.
Every audit produces the same shape: the object, the rule it tripped, the evidence read from AD, a severity, and the hand-off. Findings are exported with Export-SpnAuditHandoff or the delegation and duplicate report exporters, and the forest-level view lives in the coverage ledger →.