UPN suffixes count should be retrievable
AD-FORS-01InfoActive DirectoryDomain and forest
Part of Active Directory · Active Directory · Domain and forest · All checks
Invoke-Maester -TestId AD-FORS-01Overview
Section titled “Overview”UPN (User Principal Name) suffixes are a critical component of Active Directory authentication infrastructure. They allow users to log on using an email-style username format (user@suffix) rather than the traditional domain\username format. Understanding the UPN suffix configuration is important for:
- Authentication Experience: UPN suffixes enable a consistent logon experience across multiple domains and forests
- Identity Management: During mergers and acquisitions, UPN suffixes help maintain brand identity while consolidating directories
- Security Assessment: Unnecessary or unauthorized UPN suffixes could indicate misconfiguration or security risks
- Compliance: Some compliance frameworks require visibility into all authentication namespaces
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Regularly review configured UPN suffixes to ensure:
- Only legitimate organizational domains are configured as UPN suffixes
- Unused or deprecated UPN suffixes from past mergers are removed
- UPN suffixes align with the organization’s current domain and brand strategy
How the Test Works
Section titled “How the Test Works”This test retrieves the UPN suffixes configured at the forest level using the Get-ADForest cmdlet. It counts the number of custom UPN suffixes and reports whether any are configured. The default forest domain is not counted as a custom suffix.
Related Tests
Section titled “Related Tests”Test-MtAdUpnSuffixesDetails- Provides detailed list of all configured UPN suffixesTest-MtAdSpnSuffixesCount- Checks SPN suffix configuration for service principal management
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-FORS-01 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Domain and forest |
| Area | Infrastructure hardening |
| Resource type | Tenant |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdUpnSuffixesCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:crossRef:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/domain/Test.AD-FORS-01.ps1 - Documentation:
tests/ad/domain/Test.AD-FORS-01.md