Get-SpnsRc4Enabled.ps1

# Import the Active Directory module
Import-Module ActiveDirectory

# Search for all AD objects with SPNs
$objectsWithSPN = Get-ADObject -Filter 'ServicePrincipalName -like "*"' -Properties ServicePrincipalName, msDS-SupportedEncryptionTypes

# Iterate through each object and check for RC4 encryption
foreach ($obj in $objectsWithSPN) {
    $name = $obj.Name
    $spns = $obj.ServicePrincipalName
    $encryptionTypes = $obj."msDS-SupportedEncryptionTypes"

    # Check if RC4 is enabled (bit flag 0x4)
    $isRC4Enabled = $encryptionTypes -band 0x4

    # Output the results
    if ($isRC4Enabled) {
        Write-Host "Object: $name has RC4 enabled. SPNs: $spns"
    } else {
        Write-Host "Object: $name does not have RC4 enabled. SPNs: $spns"
    }
}