AD-DNS-11: AD DS SRV record count should be retrievable
| ID | AD-DNS-11 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | DNS |
| Security area | Infrastructure hardening |
| Resource type | DnsZone |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”SRV records are essential for Active Directory service location. They enable clients to find:
- Domain controllers (_ldap records)
- Global Catalog servers (_gc records)
- Kerberos services (_kerberos records)
- Password change services (_kpasswd records)
Missing or incorrect SRV records can prevent:
- Domain join operations
- Authentication
- Group Policy application
- Service discovery
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Monitor SRV record counts for unexpected changes
- Verify SRV records point to authorized domain controllers only
- Protect DNS zones containing SRV records from unauthorized modification
- Regularly test service location from client perspectives
How the Test Works
Section titled “How the Test Works”This test counts SRV records used by Active Directory Domain Services, including _ldap, _gc, _kerberos, and _kpasswd service records.
Related Tests
Section titled “Related Tests”Test-MtAdDnsAdSrvRecordDetails- Provides detailed SRV record information
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.