AD-FOR-02: Forest domain count should be retrievable
| ID | AD-FOR-02 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Domain and forest |
| Security area | Infrastructure hardening |
| Resource type | Tenant |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Understanding the number and names of domains in your forest is critical for:
- Security Boundaries: Each domain represents a security boundary with its own policies
- Trust Management: Understanding trust relationships between domains
- Administrative Scope: Knowing where administrative permissions apply
- Compliance Scope: Determining the scope of compliance assessments
- Disaster Recovery: Planning recovery procedures across all domains
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Minimize Domains: Fewer domains reduce complexity and attack surface
- Document Structure: Maintain documentation of all domains and their purposes
- Review Regularly: Periodically review if all domains are still needed
- Consistent Policies: Apply consistent security policies across all domains
How the Test Works
Section titled “How the Test Works”This test retrieves all domains from the Active Directory forest and counts them. It also lists all domain names for reference.
Related Tests
Section titled “Related Tests”Test-MtAdForestFunctionalLevel- Retrieves the forest functional levelTest-MtAdDomainControllerCount- Counts domain controllers in the current domain
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.