KBY Technologies Logo
Active Directory · Windows PowerShell 5.1

User accounts with service principal names (SPNs)

Which user accounts (not computers or managed service accounts) have a service principal name, and how old are their passwords?

Script

#Requires -Modules ActiveDirectory
# User accounts (objectCategory person) that have a servicePrincipalName. Read-only.
param(
    [switch]$IncludeDisabled
)

$filter = '(&(objectCategory=person)(objectClass=user)(servicePrincipalName=*))'

Get-ADUser -LDAPFilter $filter -Properties ServicePrincipalNames, PasswordLastSet, LastLogonDate, Description |
    Where-Object { $IncludeDisabled -or $_.Enabled } |
    Sort-Object PasswordLastSet |
    Select-Object Name, SamAccountName, Enabled, PasswordLastSet, LastLogonDate,
        @{ Name = 'ServicePrincipalNames'; Expression = { $_.ServicePrincipalNames -join '; ' } },
        Description

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Where to run it

A domain-joined machine with the Active Directory module (RSAT) installed.

Reading the output

  • An SPN on a user account means services authenticate as that user. Any domain user can request a Kerberos service ticket for it, and the ticket is protected with a key derived from the account's password, so an old or short password on these accounts is a risk.
  • Microsoft's group Managed Service Accounts (gMSA) handle SPNs and rotate long passwords automatically; they are a separate object class and don't appear here.
  • Only enabled accounts are listed. Pass -IncludeDisabled to list disabled ones too.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.

Get-ADUser (ActiveDirectory)about_ActiveDirectory_ObjectModel (LastLogonDate, PasswordLastSet and the account flag properties)Search filter syntax (LDAP_MATCHING_RULE_BIT_AND and presence filters)Group Managed Service Accounts overviewWhere-Object (Microsoft.PowerShell.Core)Sort-Object (Microsoft.PowerShell.Utility)Select-Object (Microsoft.PowerShell.Utility)
All scripts