Test-DbaSpn

Want to see the source code for this command? Check out Test-DbaSpn on GitHub.
Want to see the Bill Of Health for this command? Check out Test-DbaSpn.

Synopsis

Test-DbaSpn will determine what SPNs should be set for a given server (and any instances of SQL running on it) and return whether the SPNs are set or not.

Description

This function is designed to take in a server name(s) and attempt to determine required SPNs. It was initially written to mimic the (previously) broken functionality of the Microsoft Kerberos Configuration manager and SQL Server 2016.

• For any instances with TCP/IP enabled, the script will determine which port(s) the instances are listening on and generate the required SPNs.
• For named instances NOT using dynamic ports, the script will generate a port-based SPN for those instances as well.
• At a minimum, the script will test a base, port-less SPN for each instance discovered.

Once the required SPNs are generated, the script will connect to Active Directory and search for any of the SPNs (if any) that are already set. The function will return a custom object(s) that contains the server name checked, the instance name discovered, the account the service is running under, and what the "required" SPN should be. It will also return a boolean property indicating if the SPN is set in Active Directory or not.

Syntax

Test-DbaSpn
    [-ComputerName] <DbaInstanceParameter[]>
    [[-Credential] <PSCredential>]
    [-EnableException]
    [<CommonParameters>]

Examples

Example: 1

PS C:\> Test-DbaSpn -ComputerName SQLSERVERA -Credential ad\sqldba

Connects to a computer (SQLSERVERA) and queries WMI for all SQL instances and return "required" SPNs. It will then take each SPN it generates
and query Active Directory to make sure the SPNs are set.

Example: 2

PS C:\> Test-DbaSpn -ComputerName SQLSERVERA,SQLSERVERB -Credential ad\sqldba

Connects to multiple computers (SQLSERVERA, SQLSERVERB) and queries WMI for all SQL instances and return "required" SPNs.
It will then take each SPN it generates and query Active Directory to make sure the SPNs are set.

Example: 3

PS C:\> Test-DbaSpn -ComputerName SQLSERVERC -Credential ad\sqldba

Connects to a computer (SQLSERVERC) on a specified and queries WMI for all SQL instances and return "required" SPNs.
It will then take each SPN it generates and query Active Directory to make sure the SPNs are set. Note that the credential you pass must have be a valid login with appropriate rights on the domain

Required Parameters

-ComputerName

The computer you want to discover any SQL Server instances on. This parameter is required.

Optional Parameters

-Credential

The credential you want to use to connect to the remote server and active directory.

-EnableException

By default, when something goes wrong we try to catch it, interpret it and give you a friendly warning message. This avoids overwhelming you with "sea of red" exceptions, but is inconvenient because it basically disables advanced scripting. Using this switch turns this "nice by default" feature off and enables you to catch exceptions with your own try/catch.