AD-INF-013: Domain controllers that could not be probed¶

low Infrastructure MITRE ATT&CK T1557 Reads: SMB probe

Some domain controllers could not be reached over SMB, so the per-DC probe checks say nothing about them.

Also known as: unprobed-dcs

Why it matters¶

SMB signing (AD-INF-008) and the Print Spooler (AD-INF-009) are judged per domain controller, as are LDAP signing (AD-INF-005) and LDAPS channel binding (AD-INF-010). A DC that could not be probed is simply absent from those results, so a clean report can hide a DC where signing was turned off or the spooler still runs. Relay and coercion attacks pick the weakest DC, so one DC that nobody checked is enough.

How ad-doctor detects it¶

With probes enabled, ad-doctor connects to every enabled DC listed in the directory (by its dNSHostName), or only to the scanned DC with --single-dc. The scanned DC is reached through the address and --smb-port given on the command line, the others on TCP 445. When the SMB connection to a DC cannot be established, that DC is reported with the reason, for example DC02.corp.example: no SMB connection.

The LDAP signing and channel binding probes run separately; when one of them is inconclusive or fails for a DC, the reason is written to the scan notes rather than reported here. Nothing is reported with --no-probes.

Attributes and probes read

SMB connection to TCP 445

Severity¶

Always low: this is a gap in coverage, not a weakness. It matters because settings often drift between DCs and an attacker only needs the weakest one.

False positives and limits¶

Scanning from a segment without access to every DC. The DCs are probably fine; the scan just cannot tell. Scan again from a host that reaches them, or accept the finding for the DCs another scan covers (accepted risks).
Stale DC computer accounts of servers that were removed without a clean demotion are reported as unreachable. Clean up their metadata.

Fix¶

Check reachability from the scanning host to each reported DC (TCP 445, and 389 and 636 for the LDAP probes):
```
Test-NetConnection DC02.corp.example -Port 445
```
Run the scan from a host that reaches every DC, or scan each site's DCs from a host in that site with --single-dc and the DC's own name.
Remove DCs that no longer exist from the directory (metadata cleanup), after confirming they are really gone:
```
Get-ADDomainController -Filter * | Select-Object HostName, Site, IPv4Address
```

Verify¶

ad-doctor scan dc01.corp.example --ldaps -u 'CORP\auditor' --only AD-INF-013

To accept the risk instead, add an entry to the file passed with --accept (see accepted risks):

[[accept]]
check = "AD-INF-013"
objects = ["..."]        # optional; without it the whole check is accepted
reason = "..."
expires = 2027-03-31

References¶

Microsoft and vendors

MITRE ATT&CK

T1557

New in the next release.