AD-DOM-08: NetBIOS name non-standard details should be retrievable


ID	`AD-DOM-08`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Domain and forest
Security area	Infrastructure hardening
Resource type	Tenant
Reads from	On-premises Active Directory

What this checks and how to fix it

This test provides detailed information about NetBIOS naming violations, helping you:

Identify Specific Issues: See exactly which characters or length issues exist
Plan Corrections: Understand what needs to change to achieve compliance
Document Exceptions: Record non-compliant names and their specific issues
Prevent Problems: Address issues before they cause application failures

Control Type

Detective

Security Recommendation

When non-compliant NetBIOS names are identified:

Review Impact: Determine if the naming issues affect critical systems
Assess Change Feasibility: NetBIOS name changes require domain reconfiguration
Document Workarounds: If names can’t be changed, document mitigation strategies
Enforce Standards: Implement naming policies for future domains

How the Test Works

This test checks each NetBIOS name for length compliance (1-15 characters) and invalid characters (\ / : * ? “ < > |), providing detailed issue descriptions.

Test-MtAdNetbiosNameStandardCompliance - Counts non-compliant NetBIOS names
Test-MtAdDomainNameNonStandardDetails - Lists non-compliant domain names

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).