Default query policy should be retrievable
AD-CFG-07InfoActive DirectoryDirectory configuration
Part of Active Directory · Active Directory · Directory configuration · All checks
Invoke-Maester -TestId AD-CFG-07Overview
Section titled “Overview”The default query policy sets baseline resource constraints for LDAP operations. If defaults are overly permissive, AD can be more vulnerable to availability attacks and performance degradation from:
- Large/inefficient LDAP searches
- High-frequency query patterns
- Legitimate admin/service queries running with insufficient guardrails
Proper limits reduce the impact of both misuse and mistakes, improving DC resilience during incidents.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Review the default query policy and ensure it matches your organization’s acceptable performance envelope.
- Keep defaults conservative, then selectively allow exceptions only where required.
- Re-validate defaults after upgrades, migrations, or schema/config changes.
How the Test Works
Section titled “How the Test Works”This test retrieves the default LDAP query policy values and reports them as an analyzable metric so administrators can confirm baseline limits are configured as intended.
Related Tests
Section titled “Related Tests”Test-MtAdLdapQueryPolicyCount- Ensures query policy coverage/consistency across partitions.
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-CFG-07 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Directory configuration |
| Area | Infrastructure hardening |
| Resource type | Tenant |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdDefaultQueryPolicy |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/config/Test.AD-CFG-07.ps1 - Documentation:
tests/ad/config/Test.AD-CFG-07.md