Removes the SPNs created when using the DC Shadow functionality of mimikatz

Clean-DCshadow.ps1

#Requires -RunAsAdministrator

#search for accounts that have the sync SPN that aren't a Domain Controller
$shadowcomps = Get-ADObject -LDAPFilter '(&(ServicePrincipalName=E3514235-4B06-11D1-AB04-00C04FC2DCD2/*)(!(userAccountControl:1.2.840.113556.1.4.803:=8192)))' -Properties ServicePrincipalName

foreach ($scomp in $shadowcomps){
    
    $sSpns = $scomp.ServicePrincipalName | where {$_ -like "E3514235-4B06-11D1-AB04-00C04FC2DCD2/*"}
    
    foreach ($sSpn in $sSpns){
     setspn -d $sSpn $scomp.Name
    }
}