the safety model

What it will not do.

A tool that writes to Active Directory should be judged first by what it refuses. These are the refusals, why each is there, and what the product does instead.

refusal 01

It never holds a secret.

SpnManager never reads, writes, exports, regenerates, or holds a keytab, a password, or any other secret. The no-custody guarantee is structural: the keytab service seam exposes no write path. Where a fix needs a secret, the runbook shows an out-of-band placeholder and names the person who should supply it.

instead

Runbook with placeholders; the operator runs the step.

refusal 02

It never pretends an AD write fixed a keytab service.

For Linux, Java, SAP, Oracle, and appliance SSO, registering the SPN in AD without regenerating the far-side keytab at the matching KVNO leaves the service broken. Those providers are audit-and-hand-off by design. The missing-SPN finding is reportable, not fixable from here.

instead

Operator runbook: the exact commands, on which host, by whom.

refusal 03

It never writes without asking.

Every implementing command is ShouldProcess-gated. -WhatIf shows the change and stops. -Confirm asks. Execution requires the caller to hold AD write rights on the target object; the preflight checks the ACL before proposing to write.

instead

-WhatIf, -Confirm, and a preflight ACL check.

refusal 04

It never writes an SPN it has not tested.

Test runs before Execute in every lifecycle: duplicate detection across the forest, owner verification against the service's real identity, ACL check. A plan with an unresolved conflict is not executable.

instead

Test-SpnPlan; a failed test blocks the write.

refusal 05

It never touches SPNs Windows owns.

TERMSRV, WSMAN, HOST, CIFS, DNS, RPCSS, exchangeMDB and the rest are registered by Windows or by product setup. SpnManager audits drift on those and generates a hand-off for the AD administrator. It does not compete with the operating system for the attribute.

instead

Audit mode with a setspn hand-off bundle.

refusal 06

It never calls a run a Pass it cannot prove.

A proof passes only if the baseline was NTLM, the result is Kerberos, and an independent second oracle agrees. A baseline that was already Kerberos is Inconclusive.

instead

Negative-control verdicts. See Proof and evidence.

refusal 07

It never calls an unreached host clean.

A host that was not audited has zero findings by definition. The coverage ledger reports it as Unreached, a disposition of its own, and carries the count to the top of the report.

instead

Three dispositions: audited-clean, audited-findings, unreached.

refusal 08

It never acts without a record.

Every action is logged with provenance: module version, commit SHA, run ID, timestamp. Event-log integration is registered on first use.

instead

Provenance on every record.

what it does write, and when

Six providers can write to AD: SQL Server Engine, SSAS, SSRS, IIS, ADFS, SharePoint. In each case the write is a servicePrincipalName add or remove on one account, gated as described above, and followed by a proof run where an oracle exists.

Everything else is read, compare, report, hand off.

writes to AD	reads only
SQL.Engine · SQL.SSAS · SQL.SSRS	14 service providers
AD.IIS · AD.ADFS · AD.SharePoint	6 audit providers