No replication connections should be disabled
AD-REPL-01LowActive DirectoryReplication
Part of Active Directory · Active Directory · Replication · All checks
Invoke-Maester -TestId AD-REPL-01Overview
Section titled “Overview”Disabled replication connections in Active Directory can indicate several security and operational concerns:
- Replication Failures: Disabled connections may indicate failed or problematic replication between domain controllers
- Incomplete Decommissioning: Disabled connections from decommissioned DCs that weren’t properly cleaned up
- Attack Indicators: Malicious actors may disable replication to prevent detection of changes made to the directory
- Operational Risk: Inconsistent directory data across domain controllers can lead to authentication failures and access control issues
Replication connections should normally be enabled to ensure consistent directory data across all domain controllers.
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Regularly review disabled replication connections
- Investigate and resolve the root cause of disabled connections
- Remove connections for permanently decommissioned domain controllers
- Monitor for unexpected changes to replication connection status
- Document any intentionally disabled connections with business justification
How the Test Works
Section titled “How the Test Works”This test retrieves all Active Directory replication connections and counts:
- Total replication connections
- Disabled connections
- Enabled connections
- Percentage of disabled connections
Related Tests
Section titled “Related Tests”Test-MtAdNonAutoReplicationConnectionCount- Identifies manually created replication connections
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-REPL-01 |
| Severity | Low |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Replication |
| Area | Infrastructure hardening |
| Resource type | DomainController |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdDisabledReplicationConnectionCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:nTDSConnection:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/replication/Test.AD-REPL-01.ps1 - Documentation:
tests/ad/replication/Test.AD-REPL-01.md