AD-CFG-07: Default query policy should be retrievable
| ID | AD-CFG-07 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Directory configuration |
| Security area | Infrastructure hardening |
| Resource type | Tenant |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”The default query policy sets baseline resource constraints for LDAP operations. If defaults are overly permissive, AD can be more vulnerable to availability attacks and performance degradation from:
- Large/inefficient LDAP searches
- High-frequency query patterns
- Legitimate admin/service queries running with insufficient guardrails
Proper limits reduce the impact of both misuse and mistakes, improving DC resilience during incidents.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Review the default query policy and ensure it matches your organization’s acceptable performance envelope.
- Keep defaults conservative, then selectively allow exceptions only where required.
- Re-validate defaults after upgrades, migrations, or schema/config changes.
How the Test Works
Section titled “How the Test Works”This test retrieves the default LDAP query policy values and reports them as an analyzable metric so administrators can confirm baseline limits are configured as intended.
Related Tests
Section titled “Related Tests”Test-MtAdLdapQueryPolicyCount- Ensures query policy coverage/consistency across partitions.
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.