Get-ADUser SPN listing baseline

Get-ADUser -Filter {ServicePrincipalName -like "*"} -Properties ServicePrincipalName

Lists all user accounts with registered SPNs, the baseline inventory for detecting kerberoasting and poorly managed service accounts.

Run it as part of domain security hygiene: the SPN account inventory is the snapshot of your kerberoasting surface — every account with an SPN is a potential target because its hash can be requested and cracked. With this list you build the baseline: you know which service accounts exist, who uses them, and which SPNs are legitimate. From there, any TGS request for an account not on the list (or a new SPN without an approval ticket) is an anomaly. It also hunts service accounts with passwords that never rotate and duplicate SPNs, which are management issues prior to the attack.

Do not use it as kerberoasting detection per se: the list is the inventory, not the alert — the attack is seen in 4769 (BLUE·001/006), not in the existence of the SPN. In large domains (thousands of service accounts), the full output is unmanageable: filter for accounts with privileges or with SPNs that shouldn't exist (http, sql, cifs on normal user accounts). And note: Get-ADUser only sees users — SPNs of machine accounts (the most legitimate) are left out; for the complete inventory use Get-ADObject or the filter on computer accounts.