SPN Enumeration
Native Windows
setspn -L iis_service
PowerView
Get-NetUser -SPN | select samaccountname,serviceprincipalname
Get-DomainUser -SPN | name, serviceprincipalname
Remote (Linux)
sudo python3 windapsearch.py --dc-ip 192.168.192.142 --user-spns