# Registered DHCP servers count should be retrievable

DHCP servers registered in Active Directory are authorized to provide IP addresses to clients.

Source: https://maester.dev/docs/tests/AD-CFG-11

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Directory configuration · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-CFG-11
```

## Overview

DHCP servers registered in Active Directory are authorized to provide IP addresses to clients. If unauthorized DHCP servers are registered (or legitimate servers are removed), clients may receive incorrect network settings, experience instability, or be exposed to man-in-the-middle attacks via rogue DHCP.

#### Control Type

**Operational**

#### Security Recommendation
- Maintain a strict allowlist of approved DHCP servers and ensure only those servers are registered in AD.
- Remove stale/unneeded DHCP server registrations as part of routine hygiene.
- Restrict permissions for DHCP registration operations to only the DHCP administrators and automation workflows you trust.
- Alert on any change in the number of registered DHCP servers.

#### How the Test Works
- Searches Active Directory for directory objects representing authorized/registered DHCP servers.
- Counts the number of such registered server objects.
- Compares the count to an environment baseline and flags unexpected additions/removals.

#### Related Tests
- [Test-MtAdWellKnownSecurityPrincipalsCount](/docs/commands/Test-MtAdWellKnownSecurityPrincipalsCount): Helps confirm AD identity integrity.
- [Test-MtAdEnterpriseCaCount](/docs/commands/Test-MtAdEnterpriseCaCount): Complements service authorization checks for certificate infrastructure.

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-CFG-11 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Directory configuration |
| Area | Infrastructure hardening |
| Resource type | Tenant |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdRegisteredDhcpServersCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-11.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |

</details>

## Source

- Test: [`tests/ad/config/Test.AD-CFG-11.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-11.ps1)
- Documentation: [`tests/ad/config/Test.AD-CFG-11.md`](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-11.md)