Contributed by Michael SouleAll contributors →
Part of Active Directory · Active Directory · Directory configuration · All checks
```powershell title="Run this check" Invoke-Maester -TestId AD-CFG-08 ``` ## Overview **Authentication policies** control how clients can authenticate to and interact with domain controllers for certain operations (depending on configuration and policy scope). Inadequate or unexpected authentication policy configuration can: - Increase exposure of DC authentication endpoints - Allow broader authentication patterns than intended - Complicate incident investigations by enabling inconsistent authentication behavior Because authentication to domain controllers is a critical trust boundary, this test focuses on ensuring policies are explicitly configured and managed. #### Control Type **Operational** #### Security Recommendation - Ensure authentication policies are configured to restrict DC access to **authorized systems** and approved authentication behaviors. - Use change control: treat authentication policy changes as security-critical. - Validate that policy configuration aligns with your domain’s intended security baseline and any application/service requirements. #### How the Test Works This test inspects AD authentication policy configuration and reports a count/visibility metric so administrators can confirm whether authentication policies are present and aligned with expectations. #### Related Tests - `Test-MtAdDsHeuristicsCount` - Helps validate advanced directory behavior settings that can influence authentication-related behaviors. ## Details