Kerberos Service Principal Names, managed across the whole forest and proven to work.
An SPN is one string. If it is missing, duplicated, or on the wrong account, Kerberos falls back to NTLM or fails, and the symptom shows up somewhere else. SpnManager finds the string, plans the change, tests it against AD, executes or hands off, and then proves the result under a negative control.
For anything that authenticates from a keytab, it writes a runbook and stops.
Linux, Java, SAP, Oracle, and appliance SSO all hold a secret on the far side. SpnManager never reads, writes, exports, regenerates, or holds a keytab or any secret. It emits the exact commands to run, on which host, by whom, with each secret shown as an out-of-band placeholder.
Registering the SPN in AD does not by itself fix Kerberos for these services. The product refuses to pretend otherwise.
A proof passes only if the baseline was NTLM and the result is Kerberos.
The live-proof harness records the mechanism before the change, makes the change through the product's own execute path, records it after, and requires an independent second oracle to agree.
If the baseline was already Kerberos, an SPN may have pre-existed and nothing was proven. The verdict is Inconclusive, not Pass. Most tools in this space cannot tell those two apart.
| before | after | second oracle | verdict |
|---|---|---|---|
| NTLM | KERBEROS | agrees | PASS |
| KERBEROS | KERBEROS | agrees | INCONCLUSIVE |
| NTLM | NTLM | agrees | FAIL |
| NTLM | KERBEROS | disagrees | FAIL |
A host that was never reached is not clean.
A host that was never audited has zero findings by definition. Reporting that as clean is the single most dangerous thing an audit tool can do. The forest coverage ledger gives "could not reach it" its own disposition and carries the number to the top of the report.
Ephemeral forests in AWS and Azure. Real SPNs. A remote client's actual mechanism, read back.
Best results to date: 13 of 15 provider scenarios on AWS, 11 of 15 on Azure. Each run produces a signed evidence pack: provisioning log, per-host transcripts, oracle readings, a results matrix, and a teardown log.
Behind that: 1,662 PowerShell tests and 554 C# tests passing, 94.9% command coverage, and mutation testing on top of coverage, which asks whether a test would actually fail if the code changed.
The DBA or AD administrator evaluating it
Does it cover the estate, what will it change, what does it refuse to do.
What it will not do →The security or compliance reader
Delegation findings, RC4 and encryption-type drift, duplicate SPNs, and whether the coverage number can be trusted.
Audit suite →SpnManager is at version 0.4.0 and has not shipped publicly. It will be sold through Azure Marketplace and AWS Marketplace; commercial terms are set by the marketplace transaction.