AD-FORS-01 - UPN suffixes count should be retrievable

Contributed by Michael Soule with Merill FernandoAll contributors →

Overview

UPN (User Principal Name) suffixes are a critical component of Active Directory authentication infrastructure. They allow users to log on using an email-style username format (user@suffix) rather than the traditional domain\username format. Understanding the UPN suffix configuration is important for:

• Authentication Experience: UPN suffixes enable a consistent logon experience across multiple domains and forests
• Identity Management: During mergers and acquisitions, UPN suffixes help maintain brand identity while consolidating directories
• Security Assessment: Unnecessary or unauthorized UPN suffixes could indicate misconfiguration or security risks
• Compliance: Some compliance frameworks require visibility into all authentication namespaces

Security Recommendation

Regularly review configured UPN suffixes to ensure:

• Only legitimate organizational domains are configured as UPN suffixes
• Unused or deprecated UPN suffixes from past mergers are removed
• UPN suffixes align with the organization's current domain and brand strategy

How the Test Works

This test retrieves the UPN suffixes configured at the forest level using the Get-ADForest cmdlet. It counts the number of custom UPN suffixes and reports whether any are configured. The default forest domain is not counted as a custom suffix.

Related Tests

• Test-MtAdUpnSuffixesDetails - Provides detailed list of all configured UPN suffixes
• Test-MtAdSpnSuffixesCount - Checks SPN suffix configuration for service principal management

Test Metadata

Field	Value
Test ID	AD-FORS-01
Severity	Info
Suite	Active Directory
Category	AD.Forest
PowerShell test	Test-MtAdUpnSuffixesCount
Tags	AD, AD-FORS-01, AD.Forest

Source

• Pester test: tests/ad/domain/Test-MtAdUpnSuffixesCount.Tests.ps1
• PowerShell source: powershell/public/ad/domain/Test-MtAdUpnSuffixesCount.ps1