jperezduerto.info
Security in depth · Unit 24 · Lesson 11 of 14
Service names need accountable owners
Connect a Kerberos service name to its intended sign-in account before changing authority.
Helpful before thisActive Directory
After this lesson you can
- Identify a service-name registration mismatch without assuming that broader privileges repair authentication.
A service name is an authentication binding with an owner, not a request for more power.
Which account represents the service?
A service principal name, or SPN, identifies a service instance for Kerberos. Its registration associates that instance with the account the service uses to sign in. A particular SPN belongs on one account; an instance can have several distinct SPNs when clients use different names.
Changing a service’s sign-in account therefore requires reviewing its SPN registrations. Moving hosts alone does not prove the account changed. Keep the actual service identity, client-facing name, and migration record together.
Supplied record: the school poster service
The fictional school’s approved migration packet contains:
Requested service name: S1, the unchanged client-facing SPN.
Previous sign-in account: Poster-Old.
Current running account: Poster-New.
Reviewed registration: S1 remains assigned only to Poster-Old.
Observation: Kerberos authentication to the migrated service fails.
Assume the service uses the stated account for Kerberos, and both the registration and running-account records are current. This establishes a mismatch worth correcting through the service owner’s change process. It does not establish that this is the only authentication problem.
Write a bounded change decision
Your note should align S1, its intended account, and the service owner’s approval. Include other documented client names in the dependency review so a migration does not silently abandon an alias.
Acceptance requires evidence that the intended service authenticates after the approved change. Preserve its approved resource permissions. Successful authentication would not justify adding directory-administration rights, and assigning such rights would not reconcile the mismatched registration.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
The migrated service runs as Poster-New, but its requested SPN remains on Poster-Old. Which review fits this evidence?
Show the answer
Correct answer: Confirm the intended service name and account with its owner, then reconcile their registration through an approved change. The record identifies a specific naming-to-account mismatch. Correct ownership and subsequent authentication evidence are needed before declaring it resolved.
Try it
- WriteWrite a three-column change note: requested service name, running account, and registered account. Identify the owner who must reconcile the mismatch and the authentication evidence needed after an approved change.