LDAP query policy count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Directory configuration · All checks

Run this check

Invoke-Maester -TestId AD-CFG-06

Overview

LDAP query policies define resource limits for directory queries (for example, controlling maximum result sizes and query behaviors). Weak or missing limits can enable resource exhaustion against AD through:

• Expensive or unbounded queries
• Large searches that degrade DC performance
• Increased likelihood of availability-impacting denial-of-service (DoS)

This test helps ensure your directory query surface is bounded, making it harder for both accidental misconfigurations and malicious users to overwhelm AD.

Control Type

Operational

Security Recommendation

• Set LDAP query policies to enforce practical limits aligned with your operational needs.
• Ensure policies are applied consistently across relevant directory contexts/partitions.
• Combine with access controls: even with good limits, ensure only authorized clients can perform heavy queries.

How the Test Works

This test reads LDAP query policy configuration from AD and produces a count/visibility metric indicating where query policies are present and/or set according to your expected baseline.

Related Tests

• Test-MtAdDefaultQueryPolicy - Validates the baseline LDAP query limits.

Details

Every attribute of this check

Field	Value
Test ID	AD-CFG-06
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Directory configuration
Area	Infrastructure hardening
Resource type	Policy
MITRE ATT&CK	None
PowerShell test	Test-MtAdLdapQueryPolicyCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:Configuration/*:ReadProperty

Source

• Test: tests/ad/config/Test.AD-CFG-06.ps1
• Documentation: tests/ad/config/Test.AD-CFG-06.md