Computer operating system count should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Computers · All checks

Run this check

Invoke-Maester -TestId AD-DCOMP-04

Overview

• Understanding the distribution of operating systems in your Active Directory environment is crucial for security management. High OS diversity can indicate:

Security Implications:

• Legacy Systems: Older operating systems may no longer receive security updates
• Inconsistent Patching: Different OS versions may have varying patch levels
• Unsupported Platforms: End-of-life operating systems pose significant security risks
• Compliance Issues: Regulatory requirements may mandate specific OS versions

Common Scenarios:

• Windows Server 2008/2012 reaching end-of-life
• Mixed Windows and Linux environments
• Workstations running outdated client OS versions

Control Type

Operational

Security Recommendation

1. Standardize Operating Systems:

   • Minimize OS diversity where possible
   • Establish standard builds for servers and workstations
   • Maintain supported OS versions only

2. Identify End-of-Life Systems:

   • Create inventory of systems nearing end-of-life
   • Plan upgrade paths for legacy systems
   • Isolate unsupported systems if upgrades are delayed

3. Patch Management:

   • Ensure all systems receive regular security updates
   • Prioritize critical and high-severity patches
   • Test patches on representative OS versions

How the Test Works

This test analyzes computer objects in Active Directory and:

• Counts distinct operating systems
• Shows distribution percentages
• Identifies computers without OS data

Related Tests

• Test-MtAdComputerOperatingSystemDetails - Detailed OS and service pack information
• Test-MtAdComputerStaleEnabledCount - Identifies stale computer accounts
• Test-MtAdDcOperatingSystemDetails - Domain Controller OS distribution

Details

Every attribute of this check

Field	Value
Test ID	AD-DCOMP-04
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Computers
Area	Devices and endpoints
Resource type	Computer
MITRE ATT&CK	None
Supports controls	nist-800-53-r5:CM-8
PowerShell test	Test-MtAdComputerOperatingSystemCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:computer:ReadProperty

Source

• Test: tests/ad/security/Test.AD-DCOMP-04.ps1
• Documentation: tests/ad/security/Test.AD-DCOMP-04.md