AD-ROOTDSE-03: Root DSE should be synchronized


ID	`AD-ROOTDSE-03`
Severity	Low
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Replication
Security area	Infrastructure hardening
Resource type	DomainController
User impact of fixing	Low
Effort to fix	Medium
Reads from	On-premises Active Directory

What this checks and how to fix it

The Root DSE (Directory Service Agent) synchronization status indicates whether a domain controller has completed its initial replication with replication partners:

Directory Consistency: Unsynchronized DCs may have stale data
Authentication Reliability: Users may experience authentication failures
Replication Health: Indicates overall replication topology health
Operational Readiness: New or recovered DCs need to complete sync before serving clients

A synchronized status (isSynchronized = TRUE) indicates the DC is ready to serve directory requests with current data.

Control Type

Detective

Security Recommendation

Monitor synchronization status after DC promotion or recovery
Investigate DCs that remain unsynchronized for extended periods
Ensure all DCs complete initial synchronization before production use
Include synchronization status in regular health checks
Alert on unexpected synchronization failures

How the Test Works

This test checks the Root DSE isSynchronized attribute and reports:

Synchronization status (Yes/No)
Server DNS name
Domain, forest, and DC functionality levels

Test-MtAdDisabledReplicationConnectionCount - Checks for disabled replication connections
Test-MtAdNonAutoReplicationConnectionCount - Identifies manual replication connections

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).