dSHeuristics count should be retrievable
AD-CFG-02InfoActive DirectoryDirectory configuration
Part of Active Directory · Active Directory · Directory configuration · All checks
Invoke-Maester -TestId AD-CFG-02Overview
Section titled “Overview”dSHeuristics is an AD configuration setting that controls behavior for advanced directory features and legacy compatibility. Because it influences protocol-level behavior (including areas such as LDAP security expectations and feature gating), an incorrect or unexpected dSHeuristics value can:
- Leave AD behaving in a more legacy/less secure mode
- Cause authentication and directory access inconsistencies across clients
- Increase the likelihood of unsafe fallback behaviors when clients interact with AD
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Confirm dSHeuristics is set according to your domain’s hardening baseline (and any guidance for your forest/domain functional level).
- Avoid “trial-and-error” changes; instead, validate configuration changes in a controlled test window.
- Prioritize alignment with modern security requirements (including enforcing secure LDAP behavior where applicable).
How the Test Works
Section titled “How the Test Works”This test queries AD configuration for the dSHeuristics setting(s) and reports a count-style metric indicating how many relevant dSHeuristics values are present/active so you can assess whether the environment matches your expected security baseline.
Related Tests
Section titled “Related Tests”Test-MtAdLdapQueryPolicyCount- Helps ensure LDAP is protected by sane query limits.
Related links
Section titled “Related links”- Microsoft Learn: dSHeuristics attribute (MS-ADTS)
- ANSSI Active Directory checkpoints: Dangerous dsHeuristics settings
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-CFG-02 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Directory configuration |
| Area | Infrastructure hardening |
| Resource type | Tenant |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdDsHeuristicsCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/config/Test.AD-CFG-02.ps1 - Documentation:
tests/ad/config/Test.AD-CFG-02.md