SPN发现

>setspn -T 域名 -Q */*

https://github.com/PyroTek3/PowerShell-AD-Recon

Powerview
>Get-NetComputer -SPN termsrv*
>Get-NetUser -SPN

>import module GetUserSPNs.ps1

>usemodule situational_awareness/network/get_spn