# Kerberos SPN enumeration

> Enumerate Service Principal Names (SPNs) via Kerberos to identify service accounts, enabling targeted Kerberoasting attacks against AD environments.

- **URL:** https://hackindex.io/services/kerberos/enumeration/kerberos-spn-enumeration
- **Path:** Kerberos > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/kerberos/enumeration.md)
- **Published:** 2026-01-04
- **Updated:** 2026-05-15

SPNs are the directory-backed mapping Kerberos uses to locate service tickets. Enumerating SPNs identifies service accounts, service types (MSSQL/HTTP/etc.), and delegation-related attributes that change targeting.

Most SPN enumeration is performed over LDAP, even though the data is used by Kerberos.

## Prereqs and target assumptions

- `$TARGET_IP` is a Domain Controller
- `$DOMAIN` is the AD DNS domain
- Credentials are usually required for full SPN enumeration

## Kerberos SPN enumeration with nxc

This pulls raw LDAP attributes for any object with `servicePrincipalName` set. NetExec documents `--query` for raw LDAP filters and attribute selection.

```bash
nxc ldap $TARGET_IP -u "$USER" -p "$PASSWORD" --query "(servicePrincipalName=*)" "sAMAccountName servicePrincipalName objectClass memberOf userAccountControl"
```

What to do with output:

- Prefer SPNs on **user objects** over **computer objects** for Kerberoasting targets (service accounts vs machine accounts).
- Prioritize service classes that usually front business logic or credentials: `MSSQLSvc/`, `HTTP/`, `WSMAN/`, `TERMSRV/`, `LDAP/`, `CIFS/`.
- Capture `memberOf` and `userAccountControl` for privilege context and basic hygiene (disabled accounts, etc.).

Optional delegation-related attributes (permission dependent):

```bash
nxc ldap $TARGET_IP -u "$USER" -p "$PASSWORD" --query "(servicePrincipalName=*)" "sAMAccountName servicePrincipalName msDS-AllowedToDelegateTo msDS-AllowedToActOnBehalfOfOtherIdentity userAccountControl"
```

Interpretation:

- `msDS-AllowedToDelegateTo` indicates constrained delegation targets.
- `msDS-AllowedToActOnBehalfOfOtherIdentity` indicates RBCD configuration.
- These fields don’t guarantee an immediate path, but they determine what becomes possible if the SPN account is obtained later.

Before moving to exploitation, confirm which accounts are highest priority: see [Kerberoastable Service Accounts](https://hackindex.io/services/kerberos/vulnerability-discovery/kerberoastable-service-accounts) for RC4 vs AES assessment and privilege context.

## Impacket GetUserSPNs (standard Kerberoast prep)

List SPNs (no ticket requests):

```bash
impacket-GetUserSPNs "$DOMAIN/$USER:$PASSWORD" -dc-ip $TARGET_IP
```

What to expect:

- A table of accounts with SPNs and associated metadata (including which are likely user accounts).
- This is still enumeration. No ticket requests yet.

What to do next:

- Identify service accounts tied to critical services (SQL, app pools, middleware).
- If the same account owns multiple SPNs, prioritize it (one crack impacts multiple services).

Request tickets (Kerberoasting extraction) and write hashes:

```bash
impacket-GetUserSPNs "$DOMAIN/$USER:$PASSWORD" -dc-ip $TARGET_IP -request -outputfile kerberoast.hashes
```

Interpretation:

- `-request` changes the action from “list” to “extract TGS material”. That’s typically still part of the SPN workflow, but treat it as a higher-impact action than pure listing.
- `kerberoast.hashes` becomes offline cracking input: see [Kerberoasting](https://hackindex.io/services/kerberos/exploitation/kerberoasting).

## nxc Kerberoasting (ticket extraction path)

Use this when the intent is “extract now” and the engagement rules allow it.

```bash
nxc ldap $TARGET_IP -u "$USER" -p "$PASSWORD" --kerberoasting kerberoast.hashes
```

What to expect:

- Hash output per roastable SPN account.
- Failures usually indicate insufficient rights, channel issues, or hardened configurations.

## Windows-side SPN roast stats (domain joined)

This provides counts and categories before doing broad extraction.

```bash
Rubeus.exe kerberoast /stats
```

How to use it:

- If the count is small, focus on manual targeting (SQL/app services) rather than bulk extraction.
- If the count is large, prioritize by service class and by privilege context (accounts in admin groups).

## References

- [NetExec Query LDAP](https://www.netexec.wiki/ldap-protocol/query-ldap) - LDAP filter + attribute selection via --query
- [NetExec Kerberoasting](https://www.netexec.wiki/ldap-protocol/kerberoasting) - --kerberoasting ticket extraction behavior
- [Impacket](https://github.com/fortra/impacket) - Provides impacket-GetUserSPNs for SPN listing and -request extraction
- [Rubeus usage](https://specterops.gitbook.io/ghostpack/rubeus/introduction/command-line-usage) - kerberoast /stats output mode