AD-CFG-08: AuthN policy container count should be retrievable


ID	`AD-CFG-08`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Directory configuration
Security area	Authentication
Resource type	Policy
Reads from	On-premises Active Directory

What this checks and how to fix it

Authentication policies control how clients can authenticate to and interact with domain controllers for certain operations (depending on configuration and policy scope). Inadequate or unexpected authentication policy configuration can:

Increase exposure of DC authentication endpoints
Allow broader authentication patterns than intended
Complicate incident investigations by enabling inconsistent authentication behavior

Because authentication to domain controllers is a critical trust boundary, this test focuses on ensuring policies are explicitly configured and managed.

Control Type

Operational

Security Recommendation

Ensure authentication policies are configured to restrict DC access to authorized systems and approved authentication behaviors.
Use change control: treat authentication policy changes as security-critical.
Validate that policy configuration aligns with your domain’s intended security baseline and any application/service requirements.

How the Test Works

This test inspects AD authentication policy configuration and reports a count/visibility metric so administrators can confirm whether authentication policies are present and aligned with expectations.

Test-MtAdDsHeuristicsCount - Helps validate advanced directory behavior settings that can influence authentication-related behaviors.

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).