AD-CFG-06: LDAP query policy count should be retrievable


ID	`AD-CFG-06`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Directory configuration
Security area	Infrastructure hardening
Resource type	Policy
Reads from	On-premises Active Directory

What this checks and how to fix it

LDAP query policies define resource limits for directory queries (for example, controlling maximum result sizes and query behaviors). Weak or missing limits can enable resource exhaustion against AD through:

Expensive or unbounded queries
Large searches that degrade DC performance
Increased likelihood of availability-impacting denial-of-service (DoS)

This test helps ensure your directory query surface is bounded, making it harder for both accidental misconfigurations and malicious users to overwhelm AD.

Control Type

Operational

Security Recommendation

Set LDAP query policies to enforce practical limits aligned with your operational needs.
Ensure policies are applied consistently across relevant directory contexts/partitions.
Combine with access controls: even with good limits, ensure only authorized clients can perform heavy queries.

How the Test Works

This test reads LDAP query policy configuration from AD and produces a count/visibility metric indicating where query policies are present and/or set according to your expected baseline.

Test-MtAdDefaultQueryPolicy - Validates the baseline LDAP query limits.

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).