AD-DC-08: DC operating system details should be retrievable


ID	`AD-DC-08`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Domain controllers
Security area	Infrastructure hardening
Resource type	DomainController
Reads from	On-premises Active Directory

What this checks and how to fix it

Understanding the operating system distribution across your domain controllers helps with:

Security compliance: Identifying DCs on unsupported OS versions
Patch management: Planning update cycles across different OS versions
Upgrade planning: Prioritizing which DCs to upgrade first
Capacity planning: Understanding feature availability across DCs
Risk assessment: Evaluating exposure from outdated systems

Domain controllers running end-of-life operating systems are a critical security risk as they no longer receive security updates, making them vulnerable to known exploits.

Control Type

Operational

Security Recommendation

Upgrade domain controllers running end-of-life operating systems immediately.

Priority order for upgrades:

Windows Server 2008 R2 and earlier (unsupported)
Windows Server 2012/2012 R2 (extended support ended)
Windows Server 2016 (still supported, but older)

Upgrade process:

Promote new DCs on supported OS versions
Transfer FSMO roles if needed
Demote old DCs
Remove from domain

How the Test Works

This test retrieves the OperatingSystem attribute from all domain controllers and groups them by OS version, showing:

Count of DCs per OS version
Percentage distribution
Names of DCs running each OS

Test-MtAdDcOperatingSystemCount - Count of unique OS versions
Test-MtAdDomainControllerCount - Total DC count

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).