# CRL distribution points count should be retrievable

Certificate Revocation Lists (CRLs) are published at specific locations called CRL distribution points.

Source: https://maester.dev/docs/tests/AD-CFG-20

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Certificate Services · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-CFG-20
```

## Overview

Certificate Revocation Lists (CRLs) are published at specific locations called *CRL distribution points*. These endpoints enable relying parties (including AD-integrated components) to check whether certificates have been revoked.

If CRL distribution points are missing, misconfigured, or reduced unexpectedly, revocation checking can fail. That can allow previously revoked certificates to remain effectively trusted longer than intended.

Monitoring the *count* of CRL distribution points helps detect:
- Missing distribution points after CA configuration changes
- Unexpected additions (potentially pointing to untrusted or incorrect publishing locations)

#### Control Type

**Operational**

#### Security Recommendation
- Ensure CRL distribution points are configured to reliable, access-controlled endpoints.
- Validate that all intended distribution points are present and reachable from relying-party networks.
- Alert on changes to the number of distribution points—treat deviations as configuration drift.

#### How the Test Works
The test inspects AD configuration for CRL distribution point entries, counts them, and reports the current number. This provides a lightweight indicator that your revocation publication settings align with expected CA configuration.

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-CFG-20 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Certificate Services |
| Area | Infrastructure hardening |
| Resource type | CertificateAuthority |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdCrlDistributionPointsCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-20.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |

</details>

## Source

- Test: [`tests/ad/config/Test.AD-CFG-20.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-20.ps1)
- Documentation: [`tests/ad/config/Test.AD-CFG-20.md`](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-20.md)