DC operating system count should be retrievable
AD-DC-07InfoActive DirectoryDomain controllers
Part of Active Directory · Active Directory · Domain controllers · All checks
Invoke-Maester -TestId AD-DC-07Overview
Section titled “Overview”Knowing the operating systems running on your domain controllers is important for:
- Lifecycle management: Identifying DCs running end-of-life operating systems
- Security patching: Ensuring all DCs receive security updates
- Feature availability: Determining which AD features are available
- Standardization: Reducing OS variety for easier management
- Upgrade planning: Identifying DCs that need to be upgraded
Running outdated operating systems on domain controllers poses security risks as they may not receive security patches.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Standardize on a supported Windows Server version for all DCs
- Plan to upgrade DCs running end-of-life operating systems
- Ensure all DCs are receiving security updates
- Consider running the latest Windows Server version for new DCs
Current Windows Server support status:
- Windows Server 2022: Supported
- Windows Server 2019: Supported
- Windows Server 2016: Supported
- Windows Server 2012 R2: Extended support ended October 2023
- Windows Server 2012: Extended support ended October 2023
- Earlier versions: Not supported
How the Test Works
Section titled “How the Test Works”This test retrieves the OperatingSystem attribute from all domain controllers and counts the unique OS versions in use.
Related Tests
Section titled “Related Tests”Test-MtAdDcOperatingSystemDetails- Detailed OS distribution breakdownTest-MtAdDomainControllerCount- Total DC count
Related links
Section titled “Related links”- Microsoft Learn: Windows Server release information
- ANSSI Active Directory checkpoints: DC/RODC with an obsolete operating system
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-DC-07 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Domain controllers |
| Area | Infrastructure hardening |
| Resource type | DomainController |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdDcOperatingSystemCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:nTDSDSA:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/domain-controller/Test.AD-DC-07.ps1 - Documentation:
tests/ad/domain-controller/Test.AD-DC-07.md