Service Principal Name (SPN) Register and De-register in AD

Description:

A service principal name (SPN) is a unique identifier of a service instance. SPNs are used by Kerberos authentication to associate a service instance with a service logon account. This allows a client application to request that the service authenticate an account even if the client does not have the account name. 

Cause or Reason:

Before the Kerberos authentication service uses an SPN to authenticate a service, the SPN must be registered on the account object that the service instance uses to log on.

Resolution:

(1) To create /register an SPN for the FQDN of the SQL Server use the following command:

setspn -A MSSQLSvc/SQL_Server_FQDN:1433  Domain\Account

For example:

  

setspn -A MSSQLSvc/HOSTNAME.domain.com:1433 Domain\service-account

(2) To create /register SPN for web application (IIS, Sharepoint etc.) use the below commands:

 setspn -S HTTP/webappurl.domain.com   Domain\service-account

(3) To verify the SNP use the following command:

setspn –L  domain\SQL Service Account

For example:

setspn –L Domain\service-account 

(4) To delete /de-register SNP for the FQDN of the SQL Server use the following command: 

setspn -D MSSQLSvc/SQL_Server_FQDN:1433 Domain\Account

(5) Alternatively, these tasks can be performed through ADSIEDIT. Connect to default naming context, navigate through the service account, select attribute servicePrincipalName and click Edit. Be very careful as ADSIEDIT is low level editor and could impact the environment if not handled properly.

(6) Now we can add or remove the SPN associated with the service account.

Restore Deleted Objects From AD Using Recycle Bin Feature

Enable Recycle Bin Feature:

Recycle bin feature available in Windows Server 2008 R2 and later versions. Make sure this feature is enabled before restoring any deleted object in AD.

To Check open Powershell window and type below commands:

PS C:\Import-Module ActiveDirectory

PS C:\Get-ADOptionalFeature -filter

EnabledScopes blank {} shows that the Recycle bin feature is not enabled.

To enable the feature, run the below command:

PS C:\Enable-OptionalFeature 'Recycle Bin Feature' -Scope ForestOrConfigurationSet  -Target domain.com

Restore deleted objects:

To restore the deleted object we must know the GUID of the deleted object. To get the GUID of the deleted object run the below command:

PS C:\Get-ADObject -filter 'isdeleted -eq $true -and name -ne "Deleted Objects" ' -includeDeltedObjects -property * >c.txt 

Now find out the ObjectGUID from the text file and copy it. 

Run below commands with the GUID to restore the object(s).

PS C:\Restore-ADObect 4454bffb-118f-4f12-972e-60f722ee6462

The deleted object will be restored with all the permissions and group membership.

Active Directory Audit Log