Computer DNS host name count should be investigated
AD-DCOMP-07InfoActive DirectoryComputers
Part of Active Directory · Active Directory · Computers · All checks
Invoke-Maester -TestId AD-DCOMP-07Overview
Section titled “Overview”- DNS host names (the
dNSHostNameattribute) are essential for proper Active Directory functionality, particularly for Kerberos authentication and service principal name (SPN) registration.
Security Implications:
- Kerberos Authentication: Required for proper Kerberos ticket requests
- SPN Registration: Service Principal Names depend on valid DNS host names
- Name Resolution: Critical for service discovery and connectivity
- Certificate Management: SSL/TLS certificates often depend on DNS names
Missing DNS Host Names May Indicate:
- Improper computer provisioning
- Legacy systems from older AD versions
- Configuration errors during domain join
- Incomplete computer account setup
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”-
Ensure Proper Configuration:
- All computers should have valid DNS host names
- DNS names should match the computer’s actual network name
- Regular validation of DNS registration
-
DNS Integration:
- Enable dynamic DNS updates for domain members
- Verify DNS records match AD computer accounts
- Monitor for DNS registration failures
-
Remediation:
- Update computers missing DNS host names
- Delete stale computer accounts without DNS names
- Investigate provisioning process if widespread issue
How the Test Works
Section titled “How the Test Works”This test counts computers with and without the dNSHostName attribute populated and reports:
- Total computers
- Computers with DNS host names
- Computers without DNS host names
- Percentage coverage
Related Tests
Section titled “Related Tests”Test-MtAdComputerDnsZoneCount- DNS zone distributionTest-MtAdComputerDnsZoneDetails- Detailed DNS zone analysisTest-MtAdComputerSpnSetCount- SPN configuration check
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-DCOMP-07 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Computers |
| Area | Infrastructure hardening |
| Resource type | Computer |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdComputerDnsHostNameCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:computer:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/security/Test.AD-DCOMP-07.ps1 - Documentation:
tests/ad/security/Test.AD-DCOMP-07.md