ASD ISM 1834 Ensure no duplicate SPNs in Active Directory
What it says
Duplicate SPNs do not exist within the domain.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMake sure there are no duplicate identifiers for network services in the organisation's Active Directory system.
This control is about making sure there aren't any repeat identifiers for network services in our organisation's Active Directory system. If there are duplicates, it can confuse the system and potentially allow unauthorised access to sensitive information, leading to security breaches or disruptions in services.
Free. Save your status, tasks and notes.
Why it matters
Duplicate SPNs can break Kerberos integrity, letting attackers request tickets for the wrong account and impersonate services to gain access.
How to implement
The IT team should conduct a thorough inventory of all service principal names (SPNs) in the Active Directory.
Use a script or tool to extract and list all SPNs to ensure there are no duplicates. This helps in identifying and resolving any duplication quickly.
IT administrators should regularly monitor and manage SPNs.
Set up a routine check every quarter where you compare current SPNs with previous records to spot any undesired changes or duplicates.
Ensure training for IT staff: Arrange a training session where experienced IT personnel teach others about managing SPNs effectively.
This includes explaining what SPNs are, why they're important, and how to manage them without causing duplicates.
Management should enforce policy compliance: Create policies that mandate regular checks of SPN assignments and audits.
Clearly document these policies and communicate the compliance requirements to all relevant staff.
Utilise tools to automate SPN management: The IT team should integrate tools that automatically manage SPN assignments, flag duplicates, and suggest corrections.
Choose from reputable tools already reviewed for this specific purpose.
Keep it running
Run setspn -X regularly to find duplicate SPNs, then remove or correct them so each SPN maps to only one AD account.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The SPN review and inventory documentation: Request records from the latest SPN inventory review conducted by the IT team.
Look at
The list of SPNs extracted and compare with previous inventories.
Good evidence
Will show no duplicates and provide a record of changes since the last review.
- Check 2 of 5What an auditor asks for
Ask for
Proof of training programs: Request materials from any training sessions conducted for IT staff regarding SPN management. Review attendance lists and training content.
Good evidence
Includes dated records of training sessions with clear objectives and outcomes.
- Check 3 of 5What an auditor asks for
Ask for
The internal policy documentation on SPN management within Active Directory.
Look at
The policy content for clarity and the inclusion of routine checks and compliance mandates.
Good evidence
Should include details about frequency and scope of compliance checks.
- Check 4 of 5What an auditor asks for
Ask for
A demonstration of the SPN monitoring tool: Request a demonstration of the tool used for automating SPN management. Observe the tool's interface and its ability to detect duplicates.
Good evidence
Will show the tool identifying duplicates and offering recommended actions.
- Check 5 of 5What an auditor asks for
Ask for
A copy of the most recent compliance report regarding SPN checks.
Look at
Evidence of completion checks and incident handling related to SPN duplication.
Good evidence
Will have no incidents of SPN duplication and clearly indicate all checks were completed on time.
Mappings
Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.9.
ISM-1834 requires organisations to maintain a correct Active Directory configuration state by preventing or remediating duplicate SPNs, which are a security-relevant directory configuration attribute. Annex A 8.9 requires configurations (including security configurations) for services and systems to be established, documented, monitored and reviewed, which would include managing and validating AD service-account/SPN configuration baselines. ISM-1834 is one concrete configuration check/control point inside the broader configuration management discipline mandated by Annex A 8.9.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.