Skip to main content
Version: 2.2.1-preview

AD-ROOTDSE-01 - Supported SASL mechanism count should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

SASL (Simple Authentication and Security Layer) mechanisms define the authentication protocols that Active Directory supports. Understanding these mechanisms is important for:

  • Authentication Security: Different mechanisms provide different security levels
  • Protocol Compatibility: Ensuring clients can authenticate using appropriate methods
  • Security Baseline: Tracking changes to supported mechanisms that could indicate misconfiguration

The default count is typically 4 mechanisms (GSSAPI, GSS-SPNEGO, EXTERNAL, DIGEST-MD5), though this may vary by configuration.

Security Recommendation​

  • Prefer Kerberos (GSSAPI) for authentication when possible
  • Minimize use of less secure mechanisms like DIGEST-MD5
  • Monitor for unexpected changes to supported SASL mechanisms
  • Disable mechanisms that are not required in your environment
  • Ensure clients are configured to use the most secure available mechanism

How the Test Works​

This test retrieves the Root DSE and counts:

  • Number of supported SASL mechanisms
  • List of mechanism names
  • Test-MtAdSupportedSaslMechanismDetails - Provides detailed information about each mechanism

Test Metadata​

FieldValue
Test IDAD-ROOTDSE-01
SeverityInfo
SuiteActive Directory
CategoryAD.Replication
PowerShell testTest-MtAdSupportedSaslMechanismCount
TagsAD, AD-ROOTDSE-01, AD.Replication

Source​

  • Pester test: tests/ad/replication/Test-MtAdSupportedSaslMechanismCount.Tests.ps1
  • PowerShell source: powershell/public/ad/replication/Test-MtAdSupportedSaslMechanismCount.ps1