Admin Accounts with SPNs — Hidden Risk Behind Kerberoasting

🎙️ In this episode, Craig Birch breaks down one of Active Directory’s most overlooked threats: Kerberoasting via privileged accounts with Service Principal Names (SPNs).
You’ll learn how attackers exploit this common misconfiguration to extract service tickets and crack credentials offline — and how to identify and fix these accounts without breaking critical apps.

• What SPNs are — and why they matter for security
• How attackers Kerberoast high-value accounts
• Why ADUC won’t give you full visibility
• PowerShell + LDAP filters for fast SPN discovery
• How SDProp flags privileged accounts
• Why auto-remediation can backfire
• Safer alternatives: gMSAs, strong passwords, role reviews

🔍 What You’ll Learn:• What SPNs are — and why they matter for security
• How attackers Kerberoast high-value accounts
• Why ADUC won’t give you full visibility
• PowerShell + LDAP filters for fast SPN discovery
• How SDProp flags privileged accounts
• Why auto-remediation can backfire
• Safer alternatives: gMSAs, strong passwords, role reviews

🛠️ PowerShell Spotlight:Get-ADUser -LDAPFilter "(&(admincount=1)(servicePrincipalName=*))" `

-Properties servicePrincipalName |

Select-Object Name, servicePrincipalName

✅ Use this to find privileged accounts with SPNs — the ones most at risk of Kerberoasting.

• Script it — don’t rely on ADUC

• Never auto-remove SPNs without reviewing impact

• Talk to app owners before making changes

• Harden service accounts or move to gMSAs

• Monitor SDProp-marked accounts to shrink attack surface

💬 Found this helpful? Like, share, or comment. Got a topic for a future 10-minute breakdown? Drop it below — we’re listening.

📌 Powered by Guardians of the Directory