DC operating system details should be retrievable
AD-DC-08InfoActive DirectoryDomain controllers
Part of Active Directory · Active Directory · Domain controllers · All checks
Invoke-Maester -TestId AD-DC-08Overview
Section titled “Overview”Understanding the operating system distribution across your domain controllers helps with:
- Security compliance: Identifying DCs on unsupported OS versions
- Patch management: Planning update cycles across different OS versions
- Upgrade planning: Prioritizing which DCs to upgrade first
- Capacity planning: Understanding feature availability across DCs
- Risk assessment: Evaluating exposure from outdated systems
Domain controllers running end-of-life operating systems are a critical security risk as they no longer receive security updates, making them vulnerable to known exploits.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Upgrade domain controllers running end-of-life operating systems immediately.
Priority order for upgrades:
- Windows Server 2008 R2 and earlier (unsupported)
- Windows Server 2012/2012 R2 (extended support ended)
- Windows Server 2016 (still supported, but older)
Upgrade process:
- Promote new DCs on supported OS versions
- Transfer FSMO roles if needed
- Demote old DCs
- Remove from domain
How the Test Works
Section titled “How the Test Works”This test retrieves the OperatingSystem attribute from all domain controllers and groups them by OS version, showing:
- Count of DCs per OS version
- Percentage distribution
- Names of DCs running each OS
Related Tests
Section titled “Related Tests”Test-MtAdDcOperatingSystemCount- Count of unique OS versionsTest-MtAdDomainControllerCount- Total DC count
Related links
Section titled “Related links”- Microsoft Learn: Windows Server release information
- ANSSI Active Directory checkpoints: DC/RODC with an obsolete operating system
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-DC-08 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Domain controllers |
| Area | Infrastructure hardening |
| Resource type | DomainController |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdDcOperatingSystemDetails |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:nTDSDSA:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/domain-controller/Test.AD-DC-08.ps1 - Documentation:
tests/ad/domain-controller/Test.AD-DC-08.md