AD DS SRV record count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · DNS · All checks

Run this check

Invoke-Maester -TestId AD-DNS-11

Overview

SRV records are essential for Active Directory service location. They enable clients to find:

• Domain controllers (_ldap records)
• Global Catalog servers (_gc records)
• Kerberos services (_kerberos records)
• Password change services (_kpasswd records)

Missing or incorrect SRV records can prevent:

• Domain join operations
• Authentication
• Group Policy application
• Service discovery

Control Type

Operational

Security Recommendation

• Monitor SRV record counts for unexpected changes
• Verify SRV records point to authorized domain controllers only
• Protect DNS zones containing SRV records from unauthorized modification
• Regularly test service location from client perspectives

How the Test Works

This test counts SRV records used by Active Directory Domain Services, including _ldap, _gc, _kerberos, and _kpasswd service records.

Related Tests

• Test-MtAdDnsAdSrvRecordDetails - Provides detailed SRV record information

Details

Every attribute of this check

Field	Value
Test ID	AD-DNS-11
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	DNS
Area	Infrastructure hardening
Resource type	DnsZone
MITRE ATT&CK	None
PowerShell test	Test-MtAdDnsAdSrvRecordCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read

Source

• Test: tests/ad/dns/Test.AD-DNS-11.ps1
• Documentation: tests/ad/dns/Test.AD-DNS-11.md