Root server incorrect IP details should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · DNS · All checks

Run this check

Invoke-Maester -TestId AD-DNS-04

Overview

Detailed information about incorrect root server configurations is essential for:

• Rapid remediation: Knowing exactly which servers are misconfigured enables quick fixes
• Root cause analysis: Understanding the scope helps identify how the misconfiguration occurred
• Security incident response: Unexpected changes may indicate compromise or attack
• Compliance documentation: Detailed records support audit requirements

Control Type

Detective

Security Recommendation

When incorrect root server IPs are detected:

1. Document all discrepancies
2. Update root hints to match official IANA addresses
3. Investigate the cause of the discrepancy
4. Implement monitoring to detect future unauthorized changes

How the Test Works

This test provides detailed information about each root server that has an incorrect IP address, including:

• Configured IP address
• Expected (correct) IP address
• Status of all root servers

Related Tests

• Test-MtAdDnsRootServerIncorrectCount - Counts root servers with incorrect IPs

Details

Every attribute of this check

Field	Value
Test ID	AD-DNS-04
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	DNS
Area	Infrastructure hardening
Resource type	DnsZone
MITRE ATT&CK	None
PowerShell test	Test-MtAdDnsRootServerIncorrectDetails
Services	ActiveDirectory
Permissions	ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read

Source

• Test: tests/ad/dns/Test.AD-DNS-04.ps1
• Documentation: tests/ad/dns/Test.AD-DNS-04.md