Service Principal Name (SPN)

A Service Principal Name is the label Kerberos uses to find the right key for a service. When a client asks the Ticket Granting Service for access to, say, a SQL Server instance, it asks by SPN. The KDC looks up which account owns that SPN and encrypts the service ticket with that account’s key. The format encodes the service class, host, and optionally a port, such as MSSQLSvc/db01.corp.local:1433.

SPNs matter to attackers because they are enumerable. Any authenticated user can query Active Directory for every account with an SPN, which is step one of Kerberoasting: request tickets for those accounts, crack them offline, and use the recovered credentials, possibly to forge a silver ticket for the service the SPN names.

Exam relevance: know the SPN as the link between a service and its account key, and as the reconnaissance surface for service account attacks. A scenario that mentions “enumerating accounts with registered SPNs” is setting up Kerberoasting; the management answer usually involves strong service account credentials or group managed service accounts.