AD-DNS-04 - Root server incorrect IP details should be retrievable

Contributed by Michael SouleAll contributors →

Overview

Detailed information about incorrect root server configurations is essential for:

• Rapid remediation: Knowing exactly which servers are misconfigured enables quick fixes
• Root cause analysis: Understanding the scope helps identify how the misconfiguration occurred
• Security incident response: Unexpected changes may indicate compromise or attack
• Compliance documentation: Detailed records support audit requirements

Control Type

Detective

Security Recommendation

When incorrect root server IPs are detected:

1. Document all discrepancies
2. Update root hints to match official IANA addresses
3. Investigate the cause of the discrepancy
4. Implement monitoring to detect future unauthorized changes

How the Test Works

This test provides detailed information about each root server that has an incorrect IP address, including:

• Configured IP address
• Expected (correct) IP address
• Status of all root servers

Related Tests

• Test-MtAdDnsRootServerIncorrectCount - Counts root servers with incorrect IPs

Test Metadata

Field	Value
Test ID	AD-DNS-04
Severity	Info
Suite	Active Directory
Category	Active Directory - DNS Infrastructure
PowerShell test	Test-MtAdDnsRootServerIncorrectDetails
Services	ActiveDirectory
Tags	AD, AD-DNS-04, AD.DNS

Source

• Test: tests/ad/dns/Test.AD-DNS-04.ps1
• Documentation: tests/ad/dns/Test.AD-DNS-04.md