Skip to main content
Version: 2.2.1-preview

AD-DNS-04 - Root server incorrect IP details should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

Detailed information about incorrect root server configurations is essential for:

  • Rapid remediation: Knowing exactly which servers are misconfigured enables quick fixes
  • Root cause analysis: Understanding the scope helps identify how the misconfiguration occurred
  • Security incident response: Unexpected changes may indicate compromise or attack
  • Compliance documentation: Detailed records support audit requirements

Security Recommendation​

When incorrect root server IPs are detected:

  1. Document all discrepancies
  2. Update root hints to match official IANA addresses
  3. Investigate the cause of the discrepancy
  4. Implement monitoring to detect future unauthorized changes

How the Test Works​

This test provides detailed information about each root server that has an incorrect IP address, including:

  • Configured IP address
  • Expected (correct) IP address
  • Status of all root servers
  • Test-MtAdDnsRootServerIncorrectCount - Counts root servers with incorrect IPs

Test Metadata​

FieldValue
Test IDAD-DNS-04
SeverityInfo
SuiteActive Directory
CategoryAD.DNS
PowerShell testTest-MtAdDnsRootServerIncorrectDetails
TagsAD, AD-DNS-04, AD.DNS

Source​

  • Pester test: tests/ad/dns/Test-MtAdDnsRootServerIncorrectDetails.Tests.ps1
  • PowerShell source: powershell/public/ad/dns/Test-MtAdDnsRootServerIncorrectDetails.ps1