Computer DNS zone count should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Computers · All checks

Run this check

Invoke-Maester -TestId AD-DCOMP-08

Overview

• Understanding DNS zone distribution across domain computers helps identify network topology, disjoint namespace configurations, and potential DNS-related security issues.

Security and Operational Insights:

• Disjoint Namespaces: Multiple DNS zones may indicate disjoint namespace configurations
• Multi-Domain Environments: Helps understand domain and forest structure
• DNS Security: Identifies zones that need DNSSEC or other security measures
• Network Segmentation: May reveal network segmentation or perimeter boundaries

Common Scenarios:

• Single-domain environments typically have one DNS zone
• Multi-domain forests have multiple zones
• Disjoint namespaces require special configuration
• External DNS zones for perimeter networks

Control Type

Operational

Security Recommendation

1. Validate Zone Configuration:

   • Ensure all DNS zones are intentional and documented
   • Review disjoint namespace configurations
   • Verify DNS zone delegation is correct

2. DNS Security:

   • Enable DNSSEC for all DNS zones
   • Implement secure dynamic updates
   • Monitor for unauthorized zone transfers

3. Documentation:

   • Document all DNS zones and their purposes
   • Maintain network topology diagrams
   • Review during security audits

How the Test Works

This test extracts DNS zones from computer dNSHostName attributes and:

• Counts unique DNS zones
• Lists all zones in use
• Identifies computers without DNS host names

Related Tests

• Test-MtAdComputerDnsHostNameCount - DNS host name coverage
• Test-MtAdComputerDnsZoneDetails - Detailed zone breakdown
• Test-MtAdDnsZoneCount - DNS server zone analysis

Details

Every attribute of this check

Field	Value
Test ID	AD-DCOMP-08
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Computers
Area	Infrastructure hardening
Resource type	DnsZone
MITRE ATT&CK	None
PowerShell test	Test-MtAdComputerDnsZoneCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:computer:ReadProperty

Source

• Test: tests/ad/security/Test.AD-DCOMP-08.ps1
• Documentation: tests/ad/security/Test.AD-DCOMP-08.md