AD-REPL-02: Non-auto replication connection count should be investigated


ID	`AD-REPL-02`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Replication
Security area	Infrastructure hardening
Resource type	DomainController
Reads from	On-premises Active Directory

What this checks and how to fix it

Non-auto-generated (manual) replication connections bypass the Knowledge Consistency Checker (KCC) automatic topology generation. While sometimes necessary for specific scenarios, manual connections require careful management:

Topology Bypass: Manual connections don’t benefit from automatic optimization and failover
Documentation Gap: Manual connections may lack proper documentation of their business purpose
Operational Debt: Accumulated manual connections from past troubleshooting may no longer be needed
Security Risk: Undocumented connections may hide unauthorized replication paths

Control Type

Operational

Security Recommendation

Prefer auto-generated connections for standard replication topology
Document all manual connections with business justification
Regularly audit manual connections to ensure they are still required
Remove manual connections that are no longer needed
Use manual connections only for specific scenarios like site bridging

How the Test Works

This test retrieves all Active Directory replication connections and identifies:

Auto-generated vs. manual connections
Count and percentage of manual connections
Total replication connection count

Test-MtAdDisabledReplicationConnectionCount - Identifies disabled replication connections

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).