AD DS SRV record details should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · DNS · All checks

Run this check

Invoke-Maester -TestId AD-DNS-12

Overview

Detailed SRV record information is critical for:

• Troubleshooting: Understanding which servers provide which services
• Security auditing: Verifying only authorized servers are advertised
• Capacity planning: Understanding service distribution across DCs
• Incident response: Quickly identifying affected services

SRV records contain priority and weight values that control client behavior. Understanding these values helps ensure optimal and secure service location.

Control Type

Operational

Security Recommendation

Review SRV record details regularly:

• Verify target hosts are authorized domain controllers
• Check priority and weight values are appropriate
• Monitor for unauthorized SRV record additions
• Ensure SRV records are protected from modification

How the Test Works

This test provides detailed information about each AD DS SRV record, including:

• Service and protocol
• Target host and port
• Priority and weight values

Related Tests

• Test-MtAdDnsAdSrvRecordCount - Counts AD DS SRV records

Details

Every attribute of this check

Field	Value
Test ID	AD-DNS-12
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	DNS
Area	Infrastructure hardening
Resource type	DnsZone
MITRE ATT&CK	None
PowerShell test	Test-MtAdDnsAdSrvRecordDetails
Services	ActiveDirectory
Permissions	ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read

Source

• Test: tests/ad/dns/Test.AD-DNS-12.ps1
• Documentation: tests/ad/dns/Test.AD-DNS-12.md