SPNs pose a security risk?
Posted on 2009-07-06
So I was speaking with our "infrastructure guy" about implementing Service Principle Names for proper kerberos authentication with the identity pool accounts in some of or IIS websites. He starts rattling something off about SPN enabled accounts having "ring 0" access or something along those lines. Bascially some kind of low level OS access when used. Now, I understand what SPNs are and what they do but Ive never heard the "ring 0" reference used before and Im a bit confused as to what he is talking about in regards to SPNs somehow creating a security risk.
Confirm or disprove what he is saying? If he is correct, please explain to me hopefully with a little more detail why SPNs might pose a security risk. I see technet articles and such all over the place stating that this is a common and even best practice approach. But he's denying that based on his own "black hat" knowledge of active directory. Ive got nearly 10 years of experience with AD and I have never heard about SPNs being a security risk. Im not implying that I am correct, I simply would like to expand my knowledge if this is the case.