> For the complete documentation index, see [llms.txt](https://docs.wehost.co.in/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.wehost.co.in/blog/purpose-of-service-principal-names-spn-in-active-directory.md).

# Purpose of Service Principal Names (SPN) in Active Directory

## Background

* I started pondering over what exactly SPN was while looking into kerberoasting

## Introduction

* A **Service Principal Name (SPN)** is a unique identifier for a service instance in Active Directory.
* It is crucial for Kerberos authentication and helps in associating a service instance with a service sign-in account.

#### Key Purposes of SPNs

* **Unique Identification**
  * Each service instance has its own SPN.
  * Ensures clients can uniquely identify and authenticate the service.
* **Kerberos Authentication**
  * Essential for Kerberos to authenticate services.
  * Allows clients to request service authentication without needing the account name.
  * Prevents users from having to provide their credentials multiple times.
* **Service Location**
  * Helps clients locate and authenticate the service instance.
  * Used by client applications to connect to the correct service.

#### Additional Details

* **Format of SPNs**
  * SPNs typically follow the format: `serviceclass/hostname:port` or `serviceclass/hostname`.
    * Example: `HTTP/www.example.com` or `MSSQLSvc/sqlserver.example.com:1433`.
* **Setting SPNs**
  * SPNs can be set using the `setspn` command-line tool.
  * Example command: `setspn -S HTTP/www.example.com DOMAIN\username`.
* **Common Uses**
  * Web services (e.g., IIS)
  * SQL Server instances
  * LDAP services

#### Benefits of Proper SPN Configuration

* **Enhanced Security**
  * Ensures secure authentication of services.
  * Reduces the risk of credential theft.
* **Improved User Experience**
  * Seamless authentication process for users.
  * Reduces the need for multiple sign-ins.
* **Efficient Service Management**
  * Simplifies the management of service accounts.
  * Facilitates easier troubleshooting and maintenance.

## Reference

* <https://learn.microsoft.com/en-us/windows/win32/ad/service-principal-names>
* <https://rootdse.org/posts/active-directory-security-2/>
* <https://4sysops.com/archives/setspn-manage-service-principal-names-in-active-directory-from-the-command-line/>
* <https://ad-attacks.hashnode.dev/service-principal-names-spns>