Which service principal name are registered?

Wanna know if a particular service principal name is registered?

Add the following command to a batch file (called something like “get-spns.bat”) and you get a list of SPN’s registered with a given name and which account is associated with the SPN.

ldifde -f spns.txt -s domaincontroller -r “(|(msDS-AllowedToDelegateTo=*%1*)(servicePrincipalName=*%1*))” -l msDS-AllowedToDelegateTo,servicePrincipalName

usage: get-spns.bat servername/hostheader

open up the created spns.txt and voila.