Forest domain count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Domain and forest · All checks

Run this check

Invoke-Maester -TestId AD-FOR-02

Overview

Understanding the number and names of domains in your forest is critical for:

• Security Boundaries: Each domain represents a security boundary with its own policies
• Trust Management: Understanding trust relationships between domains
• Administrative Scope: Knowing where administrative permissions apply
• Compliance Scope: Determining the scope of compliance assessments
• Disaster Recovery: Planning recovery procedures across all domains

Control Type

Operational

Security Recommendation

• Minimize Domains: Fewer domains reduce complexity and attack surface
• Document Structure: Maintain documentation of all domains and their purposes
• Review Regularly: Periodically review if all domains are still needed
• Consistent Policies: Apply consistent security policies across all domains

How the Test Works

This test retrieves all domains from the Active Directory forest and counts them. It also lists all domain names for reference.

Related Tests

• Test-MtAdForestFunctionalLevel - Retrieves the forest functional level
• Test-MtAdDomainControllerCount - Counts domain controllers in the current domain

Details

Every attribute of this check

Field	Value
Test ID	AD-FOR-02
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Domain and forest
Area	Infrastructure hardening
Resource type	Tenant
MITRE ATT&CK	None
PowerShell test	Test-MtAdForestDomainCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:crossRef:ReadProperty

Source

• Test: tests/ad/domain/Test.AD-FOR-02.ps1
• Documentation: tests/ad/domain/Test.AD-FOR-02.md