---
title: "Remove-DbaSpn"
description: "Removes Service Principal Names from Active Directory service accounts and cleans up related Kerberos delegation"
url: "https://dbatools.io/Remove-DbaSpn/"
availability: "Windows only"
tags: ["SPN"]
author: "Drew Furgiuele (@pittfurg), port1433.com"
source: "https://github.com/dataplat/dbatools/blob/master/public/Remove-DbaSpn.ps1"
last_updated: "2024-01-01"
---

# Remove-DbaSpn

## Synopsis

Removes Service Principal Names from Active Directory service accounts and cleans up related Kerberos delegation

## Description

Connects to Active Directory to remove specified SPNs from SQL Server service accounts and automatically cleans up associated Kerberos delegation settings. This is essential when decommissioning SQL Server instances, changing service accounts, or troubleshooting Kerberos authentication issues where duplicate or incorrect SPNs exist. The function searches for the service account (user or computer), removes the SPN from the servicePrincipalName property, and also removes any corresponding delegation entries from msDS-AllowedToDelegateTo to maintain a clean AD environment.  
  
Requires write access to Active Directory through the provided credentials.

## Syntax

```powershell
Remove-DbaSpn
    [-SPN] <String>
    [-ServiceAccount] <String>
    [[-Credential] <PSCredential>]
    [-EnableException]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

```

## Examples

### Example 1: Connects to Active Directory and removes a provided SPN from the given account (and also the relative...

```powershell
PS C:\> Remove-DbaSpn -SPN MSSQLSvc\SQLSERVERA.domain.something -ServiceAccount domain\account
```

Connects to Active Directory and removes a provided SPN from the given account (and also the relative delegation)  

### Example 2: Connects to Active Directory and removes a provided SPN from the given account, suppressing all error...

```powershell
PS C:\> Remove-DbaSpn -SPN MSSQLSvc\SQLSERVERA.domain.something -ServiceAccount domain\account -EnableException
```

Connects to Active Directory and removes a provided SPN from the given account, suppressing all error messages and throw exceptions that can be caught instead  

### Example 3: Connects to Active Directory and removes a provided SPN to the given account

```powershell
PS C:\> Remove-DbaSpn -SPN MSSQLSvc\SQLSERVERA.domain.something -ServiceAccount domain\account -Credential ad\sqldba
```

Connects to Active Directory and removes a provided SPN to the given account. Uses alternative account to connect to AD.  

### Example 4: Shows what would happen trying to remove all set SPNs for sql2005 and the relative delegations

```powershell
PS C:\> Test-DbaSpn -ComputerName sql2005 | Where-Object { $_.isSet -eq $true } | Remove-DbaSpn -WhatIf
```

### Example 5: Removes all set SPNs for sql2005 and the relative delegations

```powershell
PS C:\> Test-DbaSpn -ComputerName sql2005 | Where-Object { $_.isSet -eq $true } | Remove-DbaSpn
```

### Required Parameters

##### -SPN

Specifies the exact Service Principal Name to remove from Active Directory. Must include the full SPN format like 'MSSQLSvc/servername:port' or 'MSSQLSvc/servername.domain.com'.  
Use this when decommissioning SQL instances, changing service accounts, or cleaning up duplicate SPNs that cause Kerberos authentication failures.

| Property | Value |
| --- | --- |
| Alias | RequiredSPN |
| Required | True |
| Pipeline | true (ByPropertyName) |
| Default Value |  |

##### -ServiceAccount

Specifies the Active Directory account (user or computer) that currently owns the SPN to be removed. Use domain\username format for user accounts or COMPUTERNAME$ for computer accounts.  
This should match the account currently running the SQL Server service that you're decommissioning or reconfiguring.

| Property | Value |
| --- | --- |
| Alias | InstanceServiceAccount,AccountName |
| Required | True |
| Pipeline | true (ByPropertyName) |
| Default Value |  |

### Optional Parameters

##### -Credential

The credential you want to use to connect to Active Directory to make the changes

| Property | Value |
| --- | --- |
| Alias |  |
| Required | False |
| Pipeline | true (ByPropertyName) |
| Default Value |  |

##### -EnableException

By default, when something goes wrong we try to catch it, interpret it and give you a friendly warning message.  
This avoids overwhelming you with "sea of red" exceptions, but is inconvenient because it basically disables advanced scripting.  
Using this switch turns this "nice by default" feature off and enables you to catch exceptions with your own try/catch.

| Property | Value |
| --- | --- |
| Alias |  |
| Required | False |
| Pipeline | false |
| Default Value | False |

##### -WhatIf

Shows what would happen if the command was executed

| Property | Value |
| --- | --- |
| Alias | wi |
| Required | False |
| Pipeline | false |
| Default Value |  |

##### -Confirm

Turns confirmations before changes on or off

| Property | Value |
| --- | --- |
| Alias | cf |
| Required | False |
| Pipeline | false |
| Default Value |  |

## Outputs

**PSCustomObject**

**Returns one or two objects per SPN removal operation, depending on what was removed:**

**First object indicates the SPN removal result:**

- Name: The Service Principal Name that was processed
- ServiceAccount: The Active Directory account from which the SPN was removed
- Property: Always "servicePrincipalName" for the first object
- IsSet: Boolean indicating whether the SPN is still set (true if removal failed, false if successful or not found)
- Notes: Status message such as "Successfully removed SPN", "SPN not found", or "Failed to remove SPN"

**Second object (if SPN removal succeeded) indicates the delegation cleanup result:**

- Name: The Service Principal Name that was processed
- ServiceAccount: The Active Directory account from which delegation was removed
- Property: Always "msDS-AllowedToDelegateTo" for the second object
- IsSet: Boolean indicating whether the delegation entry is still set (true if removal failed, false if successful or not found)
- Notes: Status message such as "Successfully removed delegation", "Delegation not found", or "Failed to remove delegation"

---

Part of [dbatools](https://dbatools.io/), a free and open source PowerShell module for SQL Server administration. Full command index: https://dbatools.io/commands/