AD-DOM-06: Domain name non-standard details should be retrievable


ID	`AD-DOM-06`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Domain and forest
Security area	Infrastructure hardening
Resource type	Tenant
Reads from	On-premises Active Directory

What this checks and how to fix it

This test provides detailed information about non-compliant domain names, helping you:

Identify Problem Domains: Pinpoint exactly which domains have naming issues
Plan Remediation: Understand the specific compliance violations
Document Exceptions: Create records of non-compliant names for audit purposes
Prevent Future Issues: Ensure new domains follow naming standards

Control Type

Detective

Security Recommendation

When non-compliant domain names are identified:

Assess Impact: Determine if the non-compliance causes actual operational issues
Document: Record the domain names and reasons for non-compliance
Plan Migration: If rename is necessary, plan carefully as it’s a complex operation
Prevent: Establish naming standards for future domain additions

How the Test Works

This test checks each domain name label against RFC 1123 standards and provides detailed information about which specific labels are non-compliant and why.

Test-MtAdDomainNameStandardCompliance - Counts non-compliant domain names
Test-MtAdNetbiosNameNonStandardDetails - Lists non-compliant NetBIOS names

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).