AD-DNS-12: AD DS SRV record details should be retrievable
| ID | AD-DNS-12 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | DNS |
| Security area | Infrastructure hardening |
| Resource type | DnsZone |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Detailed SRV record information is critical for:
- Troubleshooting: Understanding which servers provide which services
- Security auditing: Verifying only authorized servers are advertised
- Capacity planning: Understanding service distribution across DCs
- Incident response: Quickly identifying affected services
SRV records contain priority and weight values that control client behavior. Understanding these values helps ensure optimal and secure service location.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Review SRV record details regularly:
- Verify target hosts are authorized domain controllers
- Check priority and weight values are appropriate
- Monitor for unauthorized SRV record additions
- Ensure SRV records are protected from modification
How the Test Works
Section titled “How the Test Works”This test provides detailed information about each AD DS SRV record, including:
- Service and protocol
- Target host and port
- Priority and weight values
Related Tests
Section titled “Related Tests”Test-MtAdDnsAdSrvRecordCount- Counts AD DS SRV records
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.