ASD ISM 1832 SPN configuration for Active Directory accounts
What it says
Only service accounts and computer accounts are configured with Service Principal Names (SPNs).
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOnly specialised accounts should have SPNs to increase security in Active Directory setups.
This control focuses on making sure that only certain special types of accounts in a computer network, called service accounts and computer accounts, have something called Service Principal Names (SPNs). This is important because if too many accounts have SPNs, it opens up ways for attackers to potentially gain unauthorised access to sensitive information or systems.
Free. Save your status, tasks and notes.
Why it matters
Unnecessary SPNs on user accounts increase exposure to Kerberoasting and other Kerberos abuse, enabling credential compromise and lateral movement in AD.
How to implement
System administrator: Limit the setting of SPNs to only these service or computer accounts.
Use your network management tools to check which accounts currently have SPNs and remove them from regular user accounts.
IT security manager: Train staff about the importance of SPNs and why only certain accounts should have them.
Conduct a short workshop explaining how improper SPN configuration can lead to security issues.
Network administrator: Set policies to automatically alert when an SPN is added to an inappropriate account.
Configure your system to notify you via email or alerts when SPNs are altered without consent.
IT department: Regularly review and audit existing SPN configurations.
Schedule monthly checks to ensure no new SPNs are improperly assigned and document any changes.
Keep it running
Regularly audit AD for SPNs on non-service/non-computer accounts; remove any unauthorised SPNs and verify required SPNs align to documented services.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of accounts with SPNs: Request the latest report from your system management tool showing accounts with SPNs.
Look at
The names and types of accounts listed.
Good evidence
Only service and computer accounts are present.
- Check 2 of 5What an auditor asks for
Ask for
To see SPN assignment policies: Request documentation that outlines who can set SPNs and on which accounts.
Look at
Rules restricting SPN settings to appropriate accounts.
Good evidence
Clear rules exist and are enforced.
- Check 3 of 5What an auditor asks for
Ask for
Training records: Request logs showing who has been trained on SPN configuration recently.
Look at
Dates and content of training sessions.
Good evidence
All relevant staff trained in the last year with satisfactory content.
- Check 4 of 5What an auditor asks for
Ask for
An alert log: Request evidence of an alert system for SPN changes.
Look at
The alert specifications and records of past alerts triggered.
Good evidence
A functioning alert system with documented past alerts.
- Check 5 of 5What an auditor asks for
Ask for
Audit records of SPN reviews: Request documentation of the last few SPN reviews.
Look at
Details of what was checked and any actions taken.
Good evidence
Regular audits documented with corrective actions noted.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.15.
ISM-1832 requires that SPNs are only set on service and computer accounts to reduce unnecessary exposure in Active Directory. This aligns with Annex A 5.15 because limiting SPN assignment is an access control rule for a sensitive authentication-related attribute that can affect how identities are used in the environment. Annex A 5.15 is broader as it requires access control policies and procedures across information assets, not a specific AD attribute control.
This control partially meets A.8.9.
ISM-1832 requires that only service accounts and computer accounts are configured with Service Principal Names (SPNs) in Active Directory. This relates to Annex A 8.9 because restricting which accounts can hold SPNs is a specific security configuration standard that should be established, documented, implemented, monitored, and reviewed. Annex A 8.9 is broader as it covers configuration management across all IT components, not just AD SPN assignment.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.