AuthN policy container count should be retrievable
AD-CFG-08InfoActive DirectoryDirectory configuration
Part of Active Directory · Active Directory · Directory configuration · All checks
Invoke-Maester -TestId AD-CFG-08Overview
Section titled “Overview”Authentication policies control how clients can authenticate to and interact with domain controllers for certain operations (depending on configuration and policy scope). Inadequate or unexpected authentication policy configuration can:
- Increase exposure of DC authentication endpoints
- Allow broader authentication patterns than intended
- Complicate incident investigations by enabling inconsistent authentication behavior
Because authentication to domain controllers is a critical trust boundary, this test focuses on ensuring policies are explicitly configured and managed.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Ensure authentication policies are configured to restrict DC access to authorized systems and approved authentication behaviors.
- Use change control: treat authentication policy changes as security-critical.
- Validate that policy configuration aligns with your domain’s intended security baseline and any application/service requirements.
How the Test Works
Section titled “How the Test Works”This test inspects AD authentication policy configuration and reports a count/visibility metric so administrators can confirm whether authentication policies are present and aligned with expectations.
Related Tests
Section titled “Related Tests”Test-MtAdDsHeuristicsCount- Helps validate advanced directory behavior settings that can influence authentication-related behaviors.
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-CFG-08 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Directory configuration |
| Area | Authentication |
| Resource type | Policy |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdAuthNPolicyConfigCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/config/Test.AD-CFG-08.ps1 - Documentation:
tests/ad/config/Test.AD-CFG-08.md