Computer DNS zone details should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Computers · All checks

Run this check

Invoke-Maester -TestId AD-DCOMP-09

Overview

• Detailed analysis of DNS zone distribution provides visibility into Active Directory topology and helps identify potential configuration issues or security concerns related to DNS.

Security and Operational Value:

• Topology Mapping: Understand how computers are distributed across DNS domains
• Disjoint Namespace Detection: Identify computers in unexpected DNS zones
• Configuration Validation: Verify computers are in appropriate zones
• Compliance Verification: Ensure DNS configuration meets organizational standards

Potential Issues Identified:

• Computers in incorrect DNS zones
• Disjoint namespace misconfigurations
• Orphaned computer accounts
• DNS registration failures

Control Type

Operational

Security Recommendation

1. Zone Assignment Review:

   • Verify computers are in appropriate DNS zones
   • Investigate computers in unexpected zones
   • Document legitimate multi-zone scenarios

2. DNS Configuration Audit:

   • Regular review of DNS zone configuration
   • Validate DNS delegation settings
   • Check for stale or orphaned records

3. Remediation:

   • Move computers to correct zones if misconfigured
   • Delete stale computer accounts
   • Fix DNS registration issues

How the Test Works

This test provides detailed analysis:

• Breakdown of computers by DNS zone
• Counts per zone with percentages
• List of computers without DNS host names
• Distribution statistics

Related Tests

• Test-MtAdComputerDnsZoneCount - DNS zone count summary
• Test-MtAdComputerDnsHostNameCount - DNS host name coverage
• Test-MtAdAllowedDnsSuffixesCount - DNS suffix configuration

Details

Every attribute of this check

Field	Value
Test ID	AD-DCOMP-09
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Computers
Area	Infrastructure hardening
Resource type	DnsZone
MITRE ATT&CK	None
PowerShell test	Test-MtAdComputerDnsZoneDetails
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:computer:ReadProperty

Source

• Test: tests/ad/security/Test.AD-DCOMP-09.ps1
• Documentation: tests/ad/security/Test.AD-DCOMP-09.md