Version: 3.0.0-preview

AD-DCOMP-04 - Computer operating system count should be investigated

Overview

Understanding the distribution of operating systems in your Active Directory environment is crucial for security management. High OS diversity can indicate:

Security Implications:

Legacy Systems: Older operating systems may no longer receive security updates
Inconsistent Patching: Different OS versions may have varying patch levels
Unsupported Platforms: End-of-life operating systems pose significant security risks
Compliance Issues: Regulatory requirements may mandate specific OS versions

Common Scenarios:

Operational

Standardize Operating Systems:
- Minimize OS diversity where possible
- Establish standard builds for servers and workstations
- Maintain supported OS versions only
Identify End-of-Life Systems:
- Create inventory of systems nearing end-of-life
- Plan upgrade paths for legacy systems
- Isolate unsupported systems if upgrades are delayed
Patch Management:
- Ensure all systems receive regular security updates
- Prioritize critical and high-severity patches
- Test patches on representative OS versions

This test analyzes computer objects in Active Directory and:

Test-MtAdComputerOperatingSystemDetails - Detailed OS and service pack information
Test-MtAdComputerStaleEnabledCount - Identifies stale computer accounts
Test-MtAdDcOperatingSystemDetails - Domain Controller OS distribution

Field	Value
Test ID	AD-DCOMP-04
Severity	Info
Suite	Active Directory
Category	Active Directory - Security Accounts
PowerShell test	Test-MtAdComputerOperatingSystemCount
Services	ActiveDirectory
Tags	AD, AD-DCOMP-04, AD.Security