UPN suffixes details should be retrievable
AD-FORS-02InfoActive DirectoryDomain and forest
Part of Active Directory · Active Directory · Domain and forest · All checks
Invoke-Maester -TestId AD-FORS-02Overview
Section titled “Overview”Detailed visibility into UPN (User Principal Name) suffix configuration is essential for maintaining a secure and well-managed Active Directory environment. UPN suffixes directly impact:
- User Authentication: Users log on with UPN format ([email protected]), making suffix configuration critical for daily operations
- Multi-Domain Environments: Organizations with multiple domains or brands rely on UPN suffixes for seamless authentication
- Security Boundaries: Understanding configured UPN suffixes helps identify potential authentication attack surfaces
- Operational Continuity: During domain migrations or consolidations, UPN suffix management ensures user authentication continuity
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Based on the UPN suffix details retrieved:
- Audit Regularly: Review the list of UPN suffixes quarterly to ensure they align with current business requirements
- Remove Unused Suffixes: Delete UPN suffixes from divested business units or completed migration projects
- Document Changes: Maintain documentation of why each UPN suffix exists and which business unit owns it
- Monitor for Unauthorized Additions: Unexpected UPN suffixes could indicate compromise or unauthorized administrative activity
How the Test Works
Section titled “How the Test Works”This test retrieves the complete list of UPN suffixes configured at the forest level. It displays each suffix individually, allowing administrators to review the complete authentication namespace configuration. The test uses Get-ADForest to access the UPNSuffixes property.
Related Tests
Section titled “Related Tests”Test-MtAdUpnSuffixesCount- Provides a count of configured UPN suffixesTest-MtAdSpnSuffixesCount- Checks SPN suffix configuration
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-FORS-02 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Domain and forest |
| Area | Infrastructure hardening |
| Resource type | Tenant |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdUpnSuffixesDetails |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:crossRef:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/domain/Test.AD-FORS-02.ps1 - Documentation:
tests/ad/domain/Test.AD-FORS-02.md