Duplicate zone count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · DNS · All checks

Run this check

Invoke-Maester -TestId AD-DNS-15

Overview

Duplicate or conflict DNS zones (indicated by CNF: or InProgress- prefixes) indicate:

• Replication conflicts: The same zone was created on multiple DCs simultaneously
• Incomplete operations: Zone creation started but did not complete
• Directory issues: Potential problems with Active Directory replication
• Configuration drift: Inconsistent state across domain controllers

These zones should be investigated and resolved to ensure consistent DNS behavior.

Control Type

Detective

Security Recommendation

• Investigate all duplicate/conflict zones immediately
• Resolve replication conflicts following Microsoft guidance
• Verify zone consistency across all DNS servers
• Monitor for future conflict creation

How the Test Works

This test identifies zones with names containing ” CNF:” or ”..InProgress-” prefixes, which indicate replication conflicts or incomplete operations.

Related Tests

• None currently

Details

Every attribute of this check

Field	Value
Test ID	AD-DNS-15
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	DNS
Area	Infrastructure hardening
Resource type	DnsZone
MITRE ATT&CK	None
PowerShell test	Test-MtAdDnsDuplicateZoneCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read

Source

• Test: tests/ad/dns/Test.AD-DNS-15.ps1
• Documentation: tests/ad/dns/Test.AD-DNS-15.md