Skip to content
MitoMito Docs

AD-DCOMP-04: Computer operating system count should be investigated
ID AD-DCOMP-04
Severity Info
Suite Active Directory (on-premises)
Product Active Directory
Feature Computers
Security area Devices and endpoints
Resource type Computer
Framework controls nist-800-53-r5:CM-8 System Component Inventory
Reads from On-premises Active Directory

What this checks and how to fix it

Section titled “What this checks and how to fix it”
  • Understanding the distribution of operating systems in your Active Directory environment is crucial for security management. High OS diversity can indicate:

Security Implications:

  • Legacy Systems: Older operating systems may no longer receive security updates
  • Inconsistent Patching: Different OS versions may have varying patch levels
  • Unsupported Platforms: End-of-life operating systems pose significant security risks
  • Compliance Issues: Regulatory requirements may mandate specific OS versions

Common Scenarios:

  • Windows Server 2008/2012 reaching end-of-life
  • Mixed Windows and Linux environments
  • Workstations running outdated client OS versions

Control Type

Section titled “Control Type”

Operational

Security Recommendation

Section titled “Security Recommendation”

  1. Standardize Operating Systems:

    • Minimize OS diversity where possible
    • Establish standard builds for servers and workstations
    • Maintain supported OS versions only

  2. Identify End-of-Life Systems:

    • Create inventory of systems nearing end-of-life
    • Plan upgrade paths for legacy systems
    • Isolate unsupported systems if upgrades are delayed

  3. Patch Management:

    • Ensure all systems receive regular security updates
    • Prioritize critical and high-severity patches
    • Test patches on representative OS versions

How the Test Works

Section titled “How the Test Works”

This test analyzes computer objects in Active Directory and:

  • Counts distinct operating systems
  • Shows distribution percentages
  • Identifies computers without OS data
Section titled “Related Tests”
  • Test-MtAdComputerOperatingSystemDetails - Detailed OS and service pack information
  • Test-MtAdComputerStaleEnabledCount - Identifies stale computer accounts
  • Test-MtAdDcOperatingSystemDetails - Domain Controller OS distribution

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.