Skip to main content
Version: 2.2.1-preview

AD-DCOMP-05 - Computer operating system details should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

  • Detailed knowledge of operating system versions and service pack levels is essential for effective vulnerability management and security compliance. This information helps identify:

Security Risks:

  • Missing Service Packs: Systems without critical updates
  • End-of-Life Versions: Operating systems no longer receiving security patches
  • Version Fragmentation: Inconsistent patch levels across the environment
  • Unsupported Configurations: OS versions that violate security policies

Compliance Requirements:

  • Many frameworks require specific OS versions
  • Service pack levels may be mandated
  • Documentation of OS landscape is often required

Security Recommendation​

  1. Maintain Current Service Packs:

    • Apply latest service packs and cumulative updates
    • Test before deployment to production
    • Maintain rollback procedures

  2. Upgrade End-of-Life Systems:

    • Prioritize systems running unsupported OS versions
    • Develop migration plans for legacy applications
    • Consider virtualization for legacy requirements

  3. Standardize Configurations:

    • Use standard OS images for new deployments
    • Implement configuration management
    • Regular compliance scanning

How the Test Works​

This test provides detailed analysis including:

  • Operating system names and versions
  • Service pack levels
  • Distribution counts and percentages
  • Identification of systems without OS information
  • Test-MtAdComputerOperatingSystemCount - Summary OS count
  • Test-MtAdComputerStaleEnabledCount - Stale computer identification
  • Test-MtAdDcOperatingSystemDetails - Domain Controller OS details

Test Metadata​

FieldValue
Test IDAD-DCOMP-05
SeverityInfo
SuiteActive Directory
CategoryAD.Security
PowerShell testTest-MtAdComputerOperatingSystemDetails
TagsAD, AD-DCOMP-05, AD.Security

Source​

  • Pester test: tests/ad/security/Test-MtAdComputerOperatingSystemDetails.Tests.ps1
  • PowerShell source: powershell/public/ad/security/Test-MtAdComputerOperatingSystemDetails.ps1