AD-REPL-01: No replication connections should be disabled
| ID | AD-REPL-01 |
| Severity | Low |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Replication |
| Security area | Infrastructure hardening |
| Resource type | DomainController |
| User impact of fixing | Low |
| Effort to fix | Low |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Disabled replication connections in Active Directory can indicate several security and operational concerns:
- Replication Failures: Disabled connections may indicate failed or problematic replication between domain controllers
- Incomplete Decommissioning: Disabled connections from decommissioned DCs that weren’t properly cleaned up
- Attack Indicators: Malicious actors may disable replication to prevent detection of changes made to the directory
- Operational Risk: Inconsistent directory data across domain controllers can lead to authentication failures and access control issues
Replication connections should normally be enabled to ensure consistent directory data across all domain controllers.
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Regularly review disabled replication connections
- Investigate and resolve the root cause of disabled connections
- Remove connections for permanently decommissioned domain controllers
- Monitor for unexpected changes to replication connection status
- Document any intentionally disabled connections with business justification
How the Test Works
Section titled “How the Test Works”This test retrieves all Active Directory replication connections and counts:
- Total replication connections
- Disabled connections
- Enabled connections
- Percentage of disabled connections
Related Tests
Section titled “Related Tests”Test-MtAdNonAutoReplicationConnectionCount- Identifies manually created replication connections
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.