AD-CFG-02: dSHeuristics count should be retrievable


ID	`AD-CFG-02`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Directory configuration
Security area	Infrastructure hardening
Resource type	Tenant
Reads from	On-premises Active Directory

What this checks and how to fix it

dSHeuristics is an AD configuration setting that controls behavior for advanced directory features and legacy compatibility. Because it influences protocol-level behavior (including areas such as LDAP security expectations and feature gating), an incorrect or unexpected dSHeuristics value can:

Leave AD behaving in a more legacy/less secure mode
Cause authentication and directory access inconsistencies across clients
Increase the likelihood of unsafe fallback behaviors when clients interact with AD

Control Type

Operational

Security Recommendation

Confirm dSHeuristics is set according to your domain’s hardening baseline (and any guidance for your forest/domain functional level).
Avoid “trial-and-error” changes; instead, validate configuration changes in a controlled test window.
Prioritize alignment with modern security requirements (including enforcing secure LDAP behavior where applicable).

How the Test Works

This test queries AD configuration for the dSHeuristics setting(s) and reports a count-style metric indicating how many relevant dSHeuristics values are present/active so you can assess whether the environment matches your expected security baseline.

Test-MtAdLdapQueryPolicyCount - Helps ensure LDAP is protected by sane query limits.

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).