Skip to content
MitoMito Docs

AD-FORS-02: UPN suffixes details should be retrievable
ID AD-FORS-02
Severity Info
Suite Active Directory (on-premises)
Product Active Directory
Feature Domain and forest
Security area Infrastructure hardening
Resource type Tenant
Reads from On-premises Active Directory

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Detailed visibility into UPN (User Principal Name) suffix configuration is essential for maintaining a secure and well-managed Active Directory environment. UPN suffixes directly impact:

  • User Authentication: Users log on with UPN format (user@domain.com), making suffix configuration critical for daily operations
  • Multi-Domain Environments: Organizations with multiple domains or brands rely on UPN suffixes for seamless authentication
  • Security Boundaries: Understanding configured UPN suffixes helps identify potential authentication attack surfaces
  • Operational Continuity: During domain migrations or consolidations, UPN suffix management ensures user authentication continuity

Control Type

Section titled “Control Type”

Operational

Security Recommendation

Section titled “Security Recommendation”

Based on the UPN suffix details retrieved:

  1. Audit Regularly: Review the list of UPN suffixes quarterly to ensure they align with current business requirements
  2. Remove Unused Suffixes: Delete UPN suffixes from divested business units or completed migration projects
  3. Document Changes: Maintain documentation of why each UPN suffix exists and which business unit owns it
  4. Monitor for Unauthorized Additions: Unexpected UPN suffixes could indicate compromise or unauthorized administrative activity

How the Test Works

Section titled “How the Test Works”

This test retrieves the complete list of UPN suffixes configured at the forest level. It displays each suffix individually, allowing administrators to review the complete authentication namespace configuration. The test uses Get-ADForest to access the UPNSuffixes property.

Section titled “Related Tests”
  • Test-MtAdUpnSuffixesCount - Provides a count of configured UPN suffixes
  • Test-MtAdSpnSuffixesCount - Checks SPN suffix configuration

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.