How to view/add an SPN with Powershell

No need to bother with the syntax of SetSPN anymore (despite it still works).
There is now a native function built into the Get-Computer and Set-Computer cmdlets.

View all SPN for a given computer

Use the Get-ADComputer cmdlet and specify the ServicePrincipalNames parameter.
It returns an array of values you can easily expand with the Select-Object cmdlet associated with the ExpandProperty parameter.

Get-ADComputer -Identity MyComputer -Properties ServicePrincipalNames |Select-Object -ExpandProperty ServicePrincipalName

View computer SPN Service Principal Name

Change the SPN list for a given computer

This can be done with the Set-ADComputer Set-ADComputer cmdlet associated with the ServicePrincipalNames parameter.

The value you have to passe must be a hashtable, or an array of hashtables, or $Null (if you want to clear the list).

The list of valid keys is:
– Add
– Remove
– Replace

The value of the Key/Value pair can be a single string or an array of strings.

In the following example I add a single string:

Set-ADComputer @{Add='WSMAN/Mycomputer'}

And in the next example I add an array of strings:

Set-ADComputer -ServicePrincipalNames @{Add='WSMAN/Mycomputer','WSMAN/Mycomputer.MyDomain.Com'}

Here is another example with two Key/Value pairs to remove and add values at the same time.

Set-ADComputer -ServicePrincipalNames @{Add='WSMAN/Mycomputer'},@{Remove='WSMAN/Mycomputer.MyDomain.Com'}

And finally, here is how to clear the whole list:

Set-ADComputer -ServicePrincipalNames $Null

More about

Service Principal Names (MSDN)

Set-ADComputer (Microsoft Docs)

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s