quickstart

From install to a proven SPN.

Five commands. Nothing is written to AD until step four, and only if you remove -WhatIf.

Install the module

PowerShell 5.1 or 7

Install-Module SpnManager -Scope CurrentUser   # distribution: {{ tok.DISTRIBUTION_CHANNEL }}Import-Module SpnManagerGet-Command -Module SpnManager | Measure-Object   # 74

See what providers exist

PowerShell

Get-SpnProvider | Select-Object ProviderId, Capability, ProofOracle# 26 rows. Capability tells you whether it can write or only audits.

Sense and plan, without writing

PowerShell

Invoke-SpnLifecycle -ProviderId SQL.Engine -WhatIfWhat if: Performing the operation "Add SPN" on target "CN=svc_sql,...".

Execute, or hand off

PowerShell

# you hold AD write rights on the account:Invoke-SpnLifecycle -ProviderId SQL.Engine -Confirm# you do not; the AD team does:Invoke-SpnLifecycle -ProviderId SQL.Engine -PassThru |  Export-SpnRegistrationScript -OutFile .\spn-sql01.ps1

Audit the rest of the estate

PowerShell

Invoke-SpnForestAudit -ComputerList (Get-Content .\hosts.txt) -GenerateReport# read the unreached count before the findings count

Installation and requirements →How it works →Command reference →