> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/ad-discovery/local-enumeration/get-user-information-locally.md).

# Get User Information Locally

## Get Logged-on Users

### Enumeration with PowerView

#### Get-NetSession

[Get-NetSession](https://powersploit.readthedocs.io/en/latest/Recon/Get-NetSession/) returns active session information for the local (or a remote) machine. This will **not work** on newer versions of Windows!

To get active sessions for the local host

```powershell
Get-NetSession
```

To get active sessions for a remote machine

```powershell
Get-NetSession -Verbose -ComputerName client74
```

<details>

<summary>Example run</summary>

```powershell
PS C:\Tools> Get-NetSession -Verbose -ComputerName web04
VERBOSE: [Get-NetSession] Error: Access is denied
PS C:\Tools> Get-NetSession -Verbose -ComputerName client74


CName        : \\192.168.105.75
UserName     : stephanie
Time         : 0
IdleTime     : 0
ComputerName : client74

```

</details>

### Enumeration with PsLoggedOn

*PsLoggedOn*'s definition of a locally logged on user is one that has their profile loaded into the Registry, so *PsLoggedOn* determines who is logged on by scanning the keys under the HKEY\_USERS key. For each key that has a name that is a user SID (security Identifier), *PsLoggedOn* looks up the corresponding user name and displays it. To determine who is logged onto a computer via resource shares, *PsLoggedOn* uses the *NetSessionEnum* API. Note that *PsLoggedOn* will show you as logged on via resource share to remote computers that you query because a logon is required for *PsLoggedOn* to access the Registry of a remote system.

To list logons on the local host

```powershell
.\PsLoggedon.exe -nobanner
```

<details>

<summary>Example run</summary>

```powershell
PS C:\Tools\PSTools> .\PsLoggedon.exe -nobanner
Users logged on locally:
     <unknown time>             CORP\dave
     4/18/2026 1:01:00 AM       CORP\stephanie

No one is logged on via resource shares.
PS C:\Tools\PSTools>
```

</details>

To list logons on a remote machine

```powershell
.\PsLoggedon.exe -nobanner \\files04
```

Note that *PsLoggedOn* will show you as logged on via resource share to remote computers that you query because a logon is required for *PsLoggedOn* to access the Registry of a remote system.

<details>

<summary>Example run</summary>

```powershell
PS C:\Tools\PSTools> .\PsLoggedon.exe -nobanner \\files04
Users logged on locally:
     <unknown time>             CORP\jeff
Unable to query resource logons
PS C:\Tools\PSTools> .\PsLoggedon.exe -nobanner \\client74
Users logged on locally:
     <unknown time>             CORP\jeffadmin

Users logged on via resource shares:
     4/18/2026 4:47:35 AM       CORP\stephanie
PS C:\Tools\PSTools>
```

</details>

## Get SPNs

A *service principal name (SPN)* is a unique identifier of a service instance. [Kerberos authentication](https://learn.microsoft.com/en-us/windows/win32/ad/mutual-authentication-using-kerberos) uses SPNs to associate a service instance with a service sign-in account. Doing so allows a client application to request service authentication for an account even if the client doesn't have the account name.

Before the Kerberos authentication service can use an SPN to authenticate a service, the SPN must be registered on the account object that the service instance uses to sign in. A given SPN can be registered on only one account. For Win32 services, a service installer specifies the sign-in account when an instance of the service is installed. The installer then composes the SPNs and writes them as a property of the account object in Active Directory Domain Services.

SPN Format: `<service class>/<host>:<port>/<service name>`

Examples:

* `MSSQLSvc/sql.lab.local:1433/SQLEXPESS`
* `CIFS/files.lab.local`

### Get SPNs with PowerView

#### Get-DomainUser

[Get-DomainUser](https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/) is part of [PowerSploit/PowerView](https://powersploit.readthedocs.io/en/latest/Recon/#powerview). It has an alias called `Get-NetUser`.

Import the module

```powershell
powershell -ep bypass
Import-Module .\PowerView.ps1
```

To list SPNs for all users in the domain

```powershell
Get-DomainUser -SPN | select name, serviceprincipalname
```

### Get SPNs with setspn.exe

List available SPNs in a domain:

```bat
setspn.exe -q */*
```

Only show MSSQL SPNs

```bat
setspn.exe -q MSSQLSvc/*
```

To iterate through each account and query for SPNs

```powershell
$Accounts = Get-WmiObject Win32_UserAccount | Where-Object {$_.AccountType -eq "512"} | Select-Object Name
ForEach ($SA in $Accounts) {setspn.exe -L $SA.Name}
```

<details>

<summary>Example run</summary>

```powershell
PS C:\Users\stephanie> $Accounts = Get-WmiObject Win32_UserAccount | Where-Object {$_.AccountType -eq "512"} | Select-Object Name
PS C:\Users\stephanie> ForEach ($SA in $Accounts) {setspn.exe -L $SA.Name}
Registered ServicePrincipalNames for CN=Administrator,CN=Users,DC=corp,DC=com:
FindDomainForAccount: Call to DsGetDcNameWithAccountW failed with return value 0x00000525
Could not find account DefaultAccount
FindDomainForAccount: Call to DsGetDcNameWithAccountW failed with return value 0x00000525
Could not find account Guest
FindDomainForAccount: Call to DsGetDcNameWithAccountW failed with return value 0x00000525
Could not find account offsec
FindDomainForAccount: Call to DsGetDcNameWithAccountW failed with return value 0x00000525
Could not find account WDAGUtilityAccount
Registered ServicePrincipalNames for CN=Administrator,CN=Users,DC=corp,DC=com:
FindDomainForAccount: Call to DsGetDcNameWithAccountW failed with return value 0x00000525
Could not find account Guest
FindDomainForAccount: Call to DsGetDcNameWithAccountW failed with return value 0x00000525
Could not find account krbtgt
Registered ServicePrincipalNames for CN=dave,CN=Users,DC=corp,DC=com:
Registered ServicePrincipalNames for CN=stephanie,CN=Users,DC=corp,DC=com:
Registered ServicePrincipalNames for CN=jeff,CN=Users,DC=corp,DC=com:
Registered ServicePrincipalNames for CN=jeffadmin,CN=Users,DC=corp,DC=com:
Registered ServicePrincipalNames for CN=iis_service,CN=Users,DC=corp,DC=com:
        HTTP/web04.corp.com
        HTTP/web04
        HTTP/web04.corp.com:80
Registered ServicePrincipalNames for CN=pete,CN=Users,DC=corp,DC=com:
Registered ServicePrincipalNames for CN=jen,CN=Users,DC=corp,DC=com:
PS C:\Users\stephanie>
```

</details>

## Get User Information

Below are examples of tools that can be used to get information about a specific **AD/domain** user.&#x20;

For **local** users, see [Windows User Information](/ctf-notes/enum/windows-discovery/windows-user-information.md).

### AdFind.exe

To get information about a specific AD-user, in this case `administrator`, with [AdFind.exe](https://www.joeware.net/freetools/tools/adfind/usage.htm)

```bat
adfind -sc u:administrator
```

<details>

<summary>Example run</summary>

```bat
Z:\Win_Programs>adfind -sc u:administrator

AdFind V01.62.00cpp Joe Richards (support@joeware.net) October 2023

Using server: Hydra-DC.MARVEL.local:3268
Directory: Windows Server 2019

dn:CN=Administrator,CN=Users,DC=MARVEL,DC=local
>objectClass: top
>objectClass: person
>objectClass: organizationalPerson
>objectClass: user
>cn: Administrator
>description: Built-in account for administering the computer/domain
>distinguishedName: CN=Administrator,CN=Users,DC=MARVEL,DC=local
>instanceType: 4
>whenCreated: 20231111103822.0Z
>whenChanged: 20250415053232.0Z
>uSNCreated: 8196
>memberOf: CN=Group Policy Creator Owners,OU=Groups,DC=MARVEL,DC=local
>memberOf: CN=Domain Admins,OU=Groups,DC=MARVEL,DC=local
>memberOf: CN=Enterprise Admins,OU=Groups,DC=MARVEL,DC=local
>memberOf: CN=Schema Admins,OU=Groups,DC=MARVEL,DC=local
>memberOf: CN=Administrators,CN=Builtin,DC=MARVEL,DC=local
>uSNChanged: 69657
>name: Administrator
>objectguid: {B549B032-2543-409A-A566-16CFFEC39A6B}
>userAccountControl: 66048
>primaryGroupID: 513
>objectsid: S-1-5-21-1396090500-2521347296-3096082587-500
>sAMAccountName: Administrator
>sAMAccountType: 805306368
>objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=MARVEL,DC=local
>dSCorePropagationData: 20231111105420.0Z
>dSCorePropagationData: 20231111105420.0Z
>dSCorePropagationData: 20231111103910.0Z
>dSCorePropagationData: 16010101181216.0Z
>lastLogonTimestamp: 133891687525991627


1 Objects returned
```

</details>

### net.exe

To get information about a specific AD-user, in this case `tstark`, with [net.exe](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771865\(v=ws.11\))

```bat
net user /domain tstark
```

<details>

<summary>Example run</summary>

```bat
Z:\Win_Programs> net user /domain tstark
The request will be processed at a domain controller for domain MARVEL.local.

User name                    tstark
Full Name                    Tony Stark
Comment
User's comment
Country/region code          000 (System Default)
Account active               Yes
Account expires              Never

Password last set            2023-11-11 15:40:15
Password expires             Never
Password changeable          2023-11-12 15:40:15
Password required            Yes
User may change password     Yes

Workstations allowed         All
Logon script
User profile
Home directory
Last logon                   2023-11-11 17:31:43

Logon hours allowed          All

Local Group Memberships      *Administrators
Global Group memberships     *Domain Admins        *Domain Users
                             *Schema Admins        *Group Policy Creator
                             *Enterprise Admins
The command completed successfully.
```

</details>

### Get-ADUser

[Get-ADUser](https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2022-ps) from the Windows [Remote Server Administration Tools](https://learn.microsoft.com/en-us/troubleshoot/windows-server/system-management-components/remote-server-administration-tools) (RSAT)

#### Get different properties <a href="#remote-server-administration-tools-rsat-for-windows" id="remote-server-administration-tools-rsat-for-windows"></a>

{% hint style="info" %}
NOTE

Get-ADUser will show the properties in alphabetical order!
{% endhint %}

To list the most basic information about a specific user in the domain

```powershell
Get-ADUser <user_name> | select name, distinguishedname, logoncount, description, memberof
```

To list more detailed information about a specific user in the domain

```powershell
Get-ADUser <user_name> -Properties * | Select name, samaccountname, distinguishedname, logoncount, title, description, lastlogon, lastlogoff, pwdlastset, whenchanged, memberof, useraccountcontrol
```

<details>

<summary>Example run</summary>

```powershell
PS C:\Users\asrepuser1> Get-ADUser rduke -Properties * | Select name, samaccountname, distinguishedname, logoncount, title, description, lastlogon, lastlogoff, pwdlastset, whenchanged, memberof, useraccountcontrol   


name               : Raoul Duke
samaccountname     : rduke
distinguishedname  : CN=Raoul Duke,CN=Users,DC=tryhackme,DC=loc
logoncount         : 1
title              :
description        :
lastlogon          : 133915981476381897
lastlogoff         : 0
pwdlastset         : 133915959609039319
whenchanged        : 13/05/2025 09:22:25
memberof           : {}
useraccountcontrol : 66048

```

</details>

**Note** that a few properties, such as `lastLogon` and `userAccountControl`, won't be parsed and displayed only numerical values only! Use `Get-DomainUser` to get parsed values.

To get standard properties for user `beth.nolan`

```powershell
Get-ADUser <user_name>
```

<details>

<summary>Example run</summary>

```powershell
PS C:\Users\sarah.bryan> Get-ADUser beth.nolan


DistinguishedName : CN=beth.nolan,OU=Sales,OU=People,DC=za,DC=tryhackme,DC=com
Enabled           : True
GivenName         : Beth
Name              : beth.nolan
ObjectClass       : user
ObjectGUID        : c4ae7c4c-4f98-4366-b3a1-c57debe3256f
SamAccountName    : beth.nolan
SID               : S-1-5-21-3330634377-1326264276-632209373-2760
Surname           : Nolan
UserPrincipalName :

```

</details>

To get **all** properties for user `beth.nolan`

```powershell
Get-ADUser <user_name> -Properties *
```

<details>

<summary>Example run</summary>

```powershell
PS C:\Users\sarah.bryan> Get-ADUser beth.nolan -Properties *


AccountExpirationDate                :  
accountExpires                       : 9223372036854775807
AccountLockoutTime                   :
AccountNotDelegated                  : False
AllowReversiblePasswordEncryption    : False
AuthenticationPolicy                 : {}
AuthenticationPolicySilo             : {}
BadLogonCount                        : 0
badPasswordTime                      : 0
badPwdCount                          : 0
CannotChangePassword                 : False
CanonicalName                        : za.tryhackme.com/People/Sales/beth.nolan
Certificates                         : {}
City                                 :
CN                                   : beth.nolan
codePage                             : 0
Company                              :
CompoundIdentitySupported            : {}
Country                              :
countryCode                          : 0
Created                              : 2/24/2022 10:06:25 PM
createTimeStamp                      : 2/24/2022 10:06:25 PM
Deleted                              :
Department                           : Sales
Description                          :
DisplayName                          : Beth Nolan
DistinguishedName                    : CN=beth.nolan,OU=Sales,OU=People,DC=za,DC=tryhackme,DC=com
Division                             :
DoesNotRequirePreAuth                : False
dSCorePropagationData                : {1/1/1601 12:00:00 AM}
EmailAddress                         :
EmployeeID                           :
EmployeeNumber                       :
Enabled                              : True
Fax                                  :
GivenName                            : Beth
HomeDirectory                        :
HomedirRequired                      : False
HomeDrive                            :
HomePage                             :
HomePhone                            :
Initials                             :
instanceType                         : 4
isDeleted                            :
KerberosEncryptionType               : {}
LastBadPasswordAttempt               :
LastKnownParent                      :  
lastLogoff                           : 0
lastLogon                            : 0
LastLogonDate                        :
LockedOut                            : False
logonCount                           : 0
LogonWorkstations                    :
Manager                              :
MemberOf                             : {CN=Internet Access,OU=Groups,DC=za,DC=tryhackme,DC=com}
MNSLogonAccount                      : False
MobilePhone                          :
Modified                             : 2/24/2022 10:06:25 PM
modifyTimeStamp                      : 2/24/2022 10:06:25 PM
msDS-User-Account-Control-Computed   : 0
Name                                 : beth.nolan
nTSecurityDescriptor                 : System.DirectoryServices.ActiveDirectorySecurity
ObjectCategory                       : CN=Person,CN=Schema,CN=Configuration,DC=za,DC=tryhackme,DC=com
ObjectClass                          : user
ObjectGUID                           : c4ae7c4c-4f98-4366-b3a1-c57debe3256f
objectSid                            : S-1-5-21-3330634377-1326264276-632209373-2760
Office                               :
OfficePhone                          :
Organization                         :
OtherName                            :
PasswordExpired                      : False
PasswordLastSet                      : 2/24/2022 10:06:25 PM
PasswordNeverExpires                 : False
PasswordNotRequired                  : False
POBox                                :
PostalCode                           :
PrimaryGroup                         : CN=Domain Users,CN=Users,DC=za,DC=tryhackme,DC=com
primaryGroupID                       : 513
PrincipalsAllowedToDelegateToAccount : {}
ProfilePath                          :
ProtectedFromAccidentalDeletion      : False
pwdLastSet                           : 132902139856391082
SamAccountName                       : beth.nolan
sAMAccountType                       : 805306368
ScriptPath                           :
sDRightsEffective                    : 0
ServicePrincipalNames                : {}
SID                                  : S-1-5-21-3330634377-1326264276-632209373-2760
SIDHistory                           : {}
SmartcardLogonRequired               : False
sn                                   : Nolan
State                                :
StreetAddress                        :
Surname                              : Nolan
Title                                : Senior 
TrustedForDelegation                 : False
TrustedToAuthForDelegation           : False
UseDESKeyOnly                        : False
userAccountControl                   : 512
userCertificate                      : {}
UserPrincipalName                    :
uSNChanged                           : 28070
uSNCreated                           : 28066
whenChanged                          : 2/24/2022 10:06:25 PM
whenCreated                          : 2/24/2022 10:06:25 PM

```

</details>

To list only the properties with names that contains `name` of a specific user

```powershell
Get-ADUser <user_name> -Properties * | select -Property *name*
```

<details>

<summary>Example run</summary>

```powershell
PS C:\Users\sarah.bryan> Get-ADUser annette.manning -Properties * | select -Property *name*


CanonicalName         : za.tryhackme.com/People/Marketing/annette.manning
DisplayName           : Annette Manning
DistinguishedName     : CN=annette.manning,OU=Marketing,OU=People,DC=za,DC=tryhackme,DC=com
GivenName             : Annette
Name                  : annette.manning
OtherName             :
SamAccountName        : annette.manning
ServicePrincipalNames : {}
Surname               : Manning
UserPrincipalName     :
PropertyNames         : {AccountExpirationDate, accountExpires, AccountLockoutTime, AccountNotDelegated...}

```

</details>

#### Search for Admins

To search for all Admin users

```powershell
Get-ADUser -Filter "Name -like '*admin*'" | select name, distinguishedname, logoncount, description, memberof
```

### Get-DomainUser

[Get-DomainUser](https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/) is part of [PowerSploit/PowerView](https://powersploit.readthedocs.io/en/latest/Recon/#powerview). It has an alias called `Get-NetUser`.

Import the module

```powershell
powershell -ep bypass
Import-Module .\PowerView.ps1
```

#### Get different properties <a href="#remote-server-administration-tools-rsat-for-windows" id="remote-server-administration-tools-rsat-for-windows"></a>

{% hint style="info" %}
NOTE

Get-DomainUser will show the properties in what looks like random order!
{% endhint %}

To list the most basic information about all users in the domain

```powershell
Get-DomainUser | select name, distinguishedname, logoncount, description, memberof
```

To list more detailed information about all users in the domain

```powershell
Get-DomainUser | select name, samaccountname, distinguishedname, logoncount, title, description, lastlogon, lastlogoff, pwdlastset, whenchanged, memberof, useraccountcontrol
```

To list **all** information about the all users

```powershell
Get-DomainUser
```

<details>

<summary>Example run</summary>

```powershell
PS C:\Tools> Get-DomainUser


logoncount             : 572
badpasswordtime        : 3/1/2023 3:18:15 AM
description            : Built-in account for administering the computer/domain
distinguishedname      : CN=Administrator,CN=Users,DC=corp,DC=com
objectclass            : {top, person, organizationalPerson, user}
lastlogontimestamp     : 4/18/2026 12:50:14 AM
name                   : Administrator
objectsid              : S-1-5-21-1987370270-658905905-1781884369-500
samaccountname         : Administrator
admincount             : 1
codepage               : 0
samaccounttype         : USER_OBJECT
accountexpires         : NEVER
countrycode            : 0
whenchanged            : 4/18/2026 7:50:14 AM
instancetype           : 4
objectguid             : e5591000-080d-44c4-89c8-b06574a14d85
lastlogon              : 4/18/2026 1:56:04 AM
lastlogoff             : 12/31/1600 4:00:00 PM
objectcategory         : CN=Person,CN=Schema,CN=Configuration,DC=corp,DC=com
dscorepropagationdata  : {9/2/2022 11:25:58 PM, 9/2/2022 11:25:58 PM, 9/2/2022 11:10:49 PM, 1/1/1601 6:12:16 PM}
memberof               : {CN=Group Policy Creator Owners,CN=Users,DC=corp,DC=com, CN=Domain Admins,CN=Users,DC=corp,DC=com, CN=Enterprise Admins,CN=Users,DC=corp,DC=com,
                         CN=Schema Admins,CN=Users,DC=corp,DC=com...}
whencreated            : 9/2/2022 11:08:27 PM
iscriticalsystemobject : True
badpwdcount            : 0
cn                     : Administrator
useraccountcontrol     : NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD
usncreated             : 8196
primarygroupid         : 513
pwdlastset             : 8/16/2022 5:27:22 PM
usnchanged             : 557165

pwdlastset             : 12/31/1600 4:00:00 PM
logoncount             : 0
badpasswordtime        : 12/31/1600 4:00:00 PM
description            : Built-in account for guest access to the computer/domain
distinguishedname      : CN=Guest,CN=Users,DC=corp,DC=com
objectclass            : {top, person, organizationalPerson, user}
name                   : Guest
objectsid              : S-1-5-21-1987370270-658905905-1781884369-501
samaccountname         : Guest
codepage               : 0
samaccounttype         : USER_OBJECT
accountexpires         : NEVER
countrycode            : 0
whenchanged            : 9/2/2022 11:08:27 PM
instancetype           : 4
objectguid             : 3d22dfde-246a-4055-9b22-605ca28ddb35
lastlogon              : 12/31/1600 4:00:00 PM
lastlogoff             : 12/31/1600 4:00:00 PM
objectcategory         : CN=Person,CN=Schema,CN=Configuration,DC=corp,DC=com
dscorepropagationdata  : {9/2/2022 11:10:49 PM, 1/1/1601 12:00:01 AM}
memberof               : CN=Guests,CN=Builtin,DC=corp,DC=com
whencreated            : 9/2/2022 11:08:27 PM
badpwdcount            : 0
cn                     : Guest
useraccountcontrol     : ACCOUNTDISABLE, PASSWD_NOTREQD, NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD
usncreated             : 8197
primarygroupid         : 514
iscriticalsystemobject : True
usnchanged             : 8197

<---snip--->
```

</details>

#### Search for Admins

To search for all privileged users (with AdminCount = 1).&#x20;

All Active Directory objects have a hidden attribute called **AdminCount**, which is set to **Null** by default. Accounts considered special have the AdminCount value set to 1, which disables inheritance on the object and sets the security on the object to be governed by the AdminSDHolder object.

```powershell
Get-DomainUser -AdminCount | select name, samaccountname, distinguishedname, logoncount, title, description, lastlogon, lastlogoff, pwdlastset, whenchanged, 
memberof, useraccountcontrol
```

To search for all users with `admin` in their names

```ps
Get-DomainUser *admin* | select name, samaccountname, distinguishedname, logoncount, title, description, lastlogon, lastlogoff, pwdlastset, whenchanged, memberof, useraccountcontrol
```

## Resources

Active Directory Enumeration with AD Module without RSAT or Admin Privileges - Red Team Notes: <https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges>

Active Directory - Enumeration - Internal All The Things: <https://swisskyrepo.github.io/InternalAllTheThings/active-directory/ad-adds-enumerate/>

ActiveDirectory PowerShell Module - Microsoft Learn: <https://learn.microsoft.com/en-us/powershell/module/activedirectory/?view=windowsserver2022-ps>

**AdFind** - Homepage: <https://joeware.net/freetools/tools/adfind/>

**Get-ADUser** - Microsoft Learn: <https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2022-ps>

**Get-DomainUser** - PowerSploit Docs: <https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/>

**Get-NetSession** - PowerSploit Docs: <https://powersploit.readthedocs.io/en/latest/Recon/Get-NetSession/>

**Get-WmiObject** - Microsoft Learn: <https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1>

**Net user** - Microsoft Learn: <https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771865(v=ws.11)>

**PsLoggedOn** - Sysinternals - Microsoft: <https://learn.microsoft.com/en-us/sysinternals/downloads/psloggedon>

Remote Server Administration Tools (RSAT) - Microsoft Learn: <https://learn.microsoft.com/en-us/troubleshoot/windows-server/system-management-components/remote-server-administration-tools>

**setspn** - Microsoft Learn: <https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/setspn>