Empty zone count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · DNS · All checks

Run this check

Invoke-Maester -TestId AD-DNS-14

Overview

Empty DNS zones (zones with no resource records) may indicate:

• Incomplete configuration: Zones created but never populated
• Abandoned infrastructure: Services that were planned but never deployed
• Configuration errors: Failed zone creation or replication issues
• Cleanup opportunities: Removing unused zones reduces complexity

Empty zones add administrative overhead without providing value and may confuse administrators.

Control Type

Detective

Security Recommendation

• Audit empty zones regularly
• Delete zones that are no longer needed
• Document the purpose of any intentionally empty zones
• Investigate unexpected empty zones for potential issues

How the Test Works

This test identifies DNS zones that contain zero resource records of any type.

Related Tests

• Test-MtAdDnsZoneCount - Counts zones with records
• Test-MtAdDnsZonesWithOnlySoaNs - Finds zones with only default records

Details

Every attribute of this check

Field	Value
Test ID	AD-DNS-14
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	DNS
Area	Infrastructure hardening
Resource type	DnsZone
MITRE ATT&CK	None
PowerShell test	Test-MtAdDnsEmptyZoneCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read

Source

• Test: tests/ad/dns/Test.AD-DNS-14.ps1
• Documentation: tests/ad/dns/Test.AD-DNS-14.md