---
id: 3716
title: "Remove SPNs and Fix Kerberoasting"
source_domain: projectblack.io
source_url: "https://projectblack.io/blog/remove-spn-fix-kerberoasting/"
published_at: "2026-05-24 05:55"
tags: ["remediation", "active-directory", "privilege-escalation", "hardening", "kerberoasting", "spn"]
phying_url: "https://phying.com/item/3716"
lang: en
---

# Remove SPNs and Fix Kerberoasting

## Summary

A Kerberoasting remediation guide: check whether an SPN is still in use via Event ID 4769, then remove unneeded SPNs with setspn or ADUC. Also covers the impact of deleting actively used SPNs.

## Intelligence Metadata

- **Sources:** projectblack.io
- **Published:** 2026-05-24 05:55
- **Original:** https://projectblack.io/blog/remove-spn-fix-kerberoasting/
- **Phying News:** https://phying.com/item/3716