Find duplicate SPNs
Documentation: Microsoft Learn
Query Active Directory servicePrincipalName values, expand the collections, and group repeated SPNs to investigate duplicate registrations.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-ADObject -LDAPFilter "(servicePrincipalName=*)" -Properties servicePrincipalName | ForEach-Object { $_.servicePrincipalName } | Group-Object | Where-Object Count -gt 1 | Select-Object Name,Count- Stage 1Get-ADObject
-LDAPFilter -Properties - Stage 2ForEach-Object
Positional values or no named parameters - Stage 3Group-Object
Positional values or no named parameters - Stage 4Where-Object
-gt - Stage 5Select-Object
Positional values or no named parameters
How it works
Get-ADObject with an LDAP filter matching any object that has a servicePrincipalName pulls the candidates, and ForEach-Object expands the multi-valued attribute so each individual SPN becomes its own pipeline item. Group-Object called with no property buckets identical strings together, and only buckets with a count above one are reported.
Adapting it
Include the owning object by grouping on a calculated pairing of the SPN with DistinguishedName, because knowing the duplicated SPN without knowing which two accounts hold it leaves the actual remediation unstarted.
Requirements
ActiveDirectory module.
If the result is unexpected
An SPN query reports duplicates or misses a suspected authentication conflict.
The search scope or account types may omit registrations, and visually similar strings may not be identical.
- Inspect the exact SPN text and all returned account identities before changing any registration.
Validate the result
Each reported SPN maps to more than one account in the documented search scope.
Keep the check reliable
Manage SPN ownership through the service configuration and keep a record of changes.
