Skip to main content
Version: 2.2.1-preview

AD-CFG-08 - AuthN policy container count should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

Authentication policies control how clients can authenticate to and interact with domain controllers for certain operations (depending on configuration and policy scope). Inadequate or unexpected authentication policy configuration can:

  • Increase exposure of DC authentication endpoints
  • Allow broader authentication patterns than intended
  • Complicate incident investigations by enabling inconsistent authentication behavior

Because authentication to domain controllers is a critical trust boundary, this test focuses on ensuring policies are explicitly configured and managed.

Security Recommendation​

  • Ensure authentication policies are configured to restrict DC access to authorized systems and approved authentication behaviors.
  • Use change control: treat authentication policy changes as security-critical.
  • Validate that policy configuration aligns with your domain’s intended security baseline and any application/service requirements.

How the Test Works​

This test inspects AD authentication policy configuration and reports a count/visibility metric so administrators can confirm whether authentication policies are present and aligned with expectations.

  • Test-MtAdDsHeuristicsCount - Helps validate advanced directory behavior settings that can influence authentication-related behaviors.

Test Metadata​

FieldValue
Test IDAD-CFG-08
SeverityInfo
SuiteActive Directory
CategoryAD.Config
PowerShell testTest-MtAdAuthNPolicyConfigCount
TagsAD, AD-CFG-08, AD.Config

Source​

  • Pester test: tests/ad/config/Test-MtAdAuthNPolicyConfigCount.Tests.ps1
  • PowerShell source: powershell/public/ad/config/Test-MtAdAuthNPolicyConfigCount.ps1