Skip to content
MitoMito Docs

AD-DCOMP-07: Computer DNS host name count should be investigated
ID AD-DCOMP-07
Severity Info
Suite Active Directory (on-premises)
Product Active Directory
Feature Computers
Security area Infrastructure hardening
Resource type Computer
Reads from On-premises Active Directory

What this checks and how to fix it

Section titled “What this checks and how to fix it”
  • DNS host names (the dNSHostName attribute) are essential for proper Active Directory functionality, particularly for Kerberos authentication and service principal name (SPN) registration.

Security Implications:

  • Kerberos Authentication: Required for proper Kerberos ticket requests
  • SPN Registration: Service Principal Names depend on valid DNS host names
  • Name Resolution: Critical for service discovery and connectivity
  • Certificate Management: SSL/TLS certificates often depend on DNS names

Missing DNS Host Names May Indicate:

  • Improper computer provisioning
  • Legacy systems from older AD versions
  • Configuration errors during domain join
  • Incomplete computer account setup

Control Type

Section titled “Control Type”

Operational

Security Recommendation

Section titled “Security Recommendation”

  1. Ensure Proper Configuration:

    • All computers should have valid DNS host names
    • DNS names should match the computer’s actual network name
    • Regular validation of DNS registration

  2. DNS Integration:

    • Enable dynamic DNS updates for domain members
    • Verify DNS records match AD computer accounts
    • Monitor for DNS registration failures

  3. Remediation:

    • Update computers missing DNS host names
    • Delete stale computer accounts without DNS names
    • Investigate provisioning process if widespread issue

How the Test Works

Section titled “How the Test Works”

This test counts computers with and without the dNSHostName attribute populated and reports:

  • Total computers
  • Computers with DNS host names
  • Computers without DNS host names
  • Percentage coverage
Section titled “Related Tests”
  • Test-MtAdComputerDnsZoneCount - DNS zone distribution
  • Test-MtAdComputerDnsZoneDetails - Detailed DNS zone analysis
  • Test-MtAdComputerSpnSetCount - SPN configuration check

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.