AD-DFSR-01: All domain controllers should have DFS-R subscriptions
| ID | AD-DFSR-01 |
| Severity | Low |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Replication |
| Security area | Infrastructure hardening |
| Resource type | DomainController |
| User impact of fixing | Low |
| Effort to fix | Medium |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”DFS-R (Distributed File System Replication) is the modern, recommended technology for replicating SYSVOL content between domain controllers:
- Reliability: DFS-R is more reliable than the legacy FRS (File Replication Service)
- Scalability: Better handles large SYSVOL contents and many DCs
- Conflict Resolution: Superior handling of file conflicts
- Migration Status: Indicates whether the domain has migrated from FRS to DFS-R
Microsoft recommends migrating from FRS to DFS-R for all domains. A count of DFS-R subscriptions compared to DC count shows migration coverage.
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Migrate all domains from FRS to DFS-R if not already done
- Ensure all domain controllers have DFS-R subscriptions
- Monitor DFS-R replication health regularly
- Document any DCs without DFS-R subscriptions
- Plan migration for any remaining FRS-based SYSVOL replication
How the Test Works
Section titled “How the Test Works”This test counts DFS-R subscription objects and reports:
- Total DFS-R subscription count
- Domain controller count
- Coverage percentage (subscriptions vs. DCs)
- Details of subscription objects
Related Tests
Section titled “Related Tests”Test-MtAdDisabledReplicationConnectionCount- Checks AD replication connection health
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.