Contributed by Michael SouleAll contributors →
Part of Active Directory · Active Directory · Domain and forest · All checks
```powershell title="Run this check" Invoke-Maester -TestId AD-FORS-02 ``` ## Overview Detailed visibility into UPN (User Principal Name) suffix configuration is essential for maintaining a secure and well-managed Active Directory environment. UPN suffixes directly impact: * **User Authentication**: Users log on with UPN format (user@domain.com), making suffix configuration critical for daily operations * **Multi-Domain Environments**: Organizations with multiple domains or brands rely on UPN suffixes for seamless authentication * **Security Boundaries**: Understanding configured UPN suffixes helps identify potential authentication attack surfaces * **Operational Continuity**: During domain migrations or consolidations, UPN suffix management ensures user authentication continuity #### Control Type **Operational** #### Security Recommendation Based on the UPN suffix details retrieved: 1. **Audit Regularly**: Review the list of UPN suffixes quarterly to ensure they align with current business requirements 2. **Remove Unused Suffixes**: Delete UPN suffixes from divested business units or completed migration projects 3. **Document Changes**: Maintain documentation of why each UPN suffix exists and which business unit owns it 4. **Monitor for Unauthorized Additions**: Unexpected UPN suffixes could indicate compromise or unauthorized administrative activity #### How the Test Works This test retrieves the complete list of UPN suffixes configured at the forest level. It displays each suffix individually, allowing administrators to review the complete authentication namespace configuration. The test uses `Get-ADForest` to access the `UPNSuffixes` property. #### Related Tests - `Test-MtAdUpnSuffixesCount` - Provides a count of configured UPN suffixes - `Test-MtAdSpnSuffixesCount` - Checks SPN suffix configuration ## Details