6.2.4 Enumerate service accounts and SPNs
AD cheatsheet | §6 — AD Notes | §6.5.3 — Read output
A domain directory query context, with user/group enumeration available.
Where to look: Inspect servicePrincipalName on selected accounts. Associate the service class, hostname and port with the owning user/computer, its groups, account state and useful rights. User-backed service identities and machine accounts have different typical password conditions.
Expected behavior / secure boundary: SPNs are normal Kerberos registrations. A service ticket being requestable is expected behavior and does not prove a weak password, reachable service or privileged account. Long random managed/computer secrets are usually poor offline-guessing candidates.
These commands are study references for a later scoped exercise. Replace placeholders for the selected environment; the output below is synthetic, not a recorded target result. Commands that collect secrets, request tickets, create sessions or change directory state require their stated prerequisites.
6.2.4.1 Baseline SPN queries using setspn
Run: Windows with setspn available. Requires: Tool execution prerequisites and permitted domain directory queries; do not assume the binary is installed. Effect: Lists registrations; the shown -Q/-L forms do not add SPNs.
setspn -Q */*
setspn -L ACCOUNT
6.2.4.2 Find service identities for targeted follow-up SPN enumeration using PowerView
Run: Windows PowerShell with reviewed PowerView. Requires: Loaded compatible module and authenticated directory query context. Effect: Reads SPN-owning account attributes.
Get-DomainUser -SPN | Select-Object samaccountname,serviceprincipalname,memberof,useraccountcontrol,pwdlastset
What this checks: setspn inventories registrations; PowerView joins SPNs to account attributes. This is account/service mapping. Requesting offline guessing material and deciding whether cracking is worthwhile belong to the next page.
6.2.4.3 Interpret the output
Raw/view evidence first. These are synthetic, abbreviated tool or graph-view excerpts. Graph relationship rows are a representative view, not collector console output. Version-specific wording and spacing can differ. The normalized observations below are a separate interpretation.
6.2.4.3.1 Expected — raw evidence
Command/view: setspn -L ACCOUNT (computer-account example)
Registered ServicePrincipalNames for CN=WS01,OU=Computers,DC=example,DC=test:
HOST/WS01
HOST/WS01.example.test
Decisive clue: HOST registrations on a computer account.
Supported: These are ordinary service-identity registrations.
Still missing: No weak secret or useful controlled account right was demonstrated.
Next check: §6.2.1.1 — Baseline enumeration — users and groups
6.2.4.3.2 Interesting — raw evidence
Command/view: setspn -L ACCOUNT (user-backed service example)
Registered ServicePrincipalNames for CN=svc_reports,OU=Services,DC=example,DC=test:
MSSQLSvc/DB01.example.test:1433
Decisive clue: MSSQLSvc registration owned by svc_reports.
Supported: The account/service relationship is a selected Kerberoasting candidate.
Still missing: Account value/type, ticket-request prerequisites and offline feasibility still determine usefulness.
Next check: §6.3.4.1 — Kerberoasting — selection and output
6.2.4.3.3 Failed / inconclusive — raw evidence
Command/view: PowerShell directory-query failure excerpt
Exception calling "FindAll" with "0" argument(s):
"The server is not operational."
Decisive clue: The directory query did not complete.
Supported: No complete SPN inventory was obtained.
Still missing: Check selected directory server, authentication context and route; this is not proof of no SPNs.
Next check: §6.1.1.1 — Establish the current identity and domain
Normalized observations: the following is a synthetic interpretation example, not literal output from one command. Placeholder ciphers and secrets are deliberately unusable.
samaccountname: svc_reports
serviceprincipalname: MSSQLSvc/DB01.example.test:1433
memberof: CN=Reporting Operators,OU=Groups,DC=example,DC=test
| Interpreted result | What it establishes | Required next check | Continue at |
|---|---|---|---|
| MSSQLSvc | A SQL Server service-class registration. | Associate it with DB01:1433; verify reachability separately. | §6.2.6.1 — Validate host-specific access rights |
| svc_reports | The SPN-owning account. | Inspect account type, groups and useful permissions. | §6.2.1.1 — Baseline enumeration — users and groups |
| Reporting Operators | An account-value clue. | Determine actual rights rather than inferring privilege from the group name. | §6.2.5.1 — Enumerate and validate effective object permissions |
Stop when: The service registration is tied to its owning account and a concrete account-value question.
Revisit only when: A new account right, service route or justified password strategy changes the value.
6.2.4.4 Decide and continue
| Result | Decision | Next numbered section |
|---|---|---|
| Enabled after validation | A user SPN account has useful rights and compatible request conditions: consider selected Kerberoasting. | §6.3.4.1 — Kerberoasting — selection and output |
| Ruled out in this context | The account offers no useful transition or has an infeasible managed secret: deprioritize offline guessing. | §6.2.5.1 — Enumerate and validate effective object permissions |
| Inconclusive / failed check | The service is unreachable: account enumeration still stands; remote service access remains unproved. | §6.2.6.1 — Validate host-specific access rights |
6.2.4.5 Tooling and complete procedure
setspn is the Windows baseline; reviewed PowerView or LDAP provides attributes. The PowerView module must already be loaded and compatible. The commands above are extracts from the owning procedure; Windows-host and Kali/target tool availability must be checked in that environment. No installation or target execution is implied by this page.
Open the owning procedure, prerequisites and complete variants. Study mechanisms and alternatives. Shared concepts. §6.6.2 — Choose an approach.