{"id":4594,"date":"2025-09-18T20:03:00","date_gmt":"2025-09-19T00:03:00","guid":{"rendered":"https:\/\/adsecurity.org\/?p=4594"},"modified":"2025-09-15T11:13:51","modified_gmt":"2025-09-15T15:13:51","slug":"active-directory-security-tip-6-domain-controller-operating-system-versions","status":"publish","type":"post","link":"https:\/\/adsecurity.org\/?p=4594","title":{"rendered":"Active Directory Security Tip #6: Domain Controller Operating System Versions"},"content":{"rendered":"\n<p>Ensuring proper Domain Controller configuration is key for Active Directory security. <br><br>Part of this is making sure they are running supported versions of Windows. At this point, DCs should be running at least Windows Server 2016, preferably Windows Server 2019 or 2022. <br><br>Hold off on deploying Windows Server 2025 DCs for now due to the dMSA issue (<a href=\"https:\/\/www.akamai.com\/blog\/security-research\/abusing-dmsa-for-privilege-escalation-in-active-directory\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/akamai.com\/blog\/security-research\/abusing-dmsa-for-privilege-escalation-in-active-directory<\/a>). <br><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"629\" height=\"75\" src=\"https:\/\/adsecurity.org\/wp-content\/uploads\/2025\/09\/GvgjxyDXAAAwyKx.png\" alt=\"\" class=\"wp-image-4595\" srcset=\"https:\/\/adsecurity.org\/wp-content\/uploads\/2025\/09\/GvgjxyDXAAAwyKx.png 629w, https:\/\/adsecurity.org\/wp-content\/uploads\/2025\/09\/GvgjxyDXAAAwyKx-300x36.png 300w\" sizes=\"auto, (max-width: 629px) 100vw, 629px\" \/><\/figure>\n\n\n\n<p><br><strong>Active Directory PowerShell code for Domain Controller operating system versions &amp; site location for the current domain:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$Domain = $env:userdnsdomain\n$DomainDC = (Get-ADDomainController -Discover -DomainName $Domain).Name\n$DomainDCs = Get-ADDomainController -Filter * -Server $DomainDC\n$DomainDCs | Select HostName,IPv4Address,OperatingSystem,Site | Sort HostName | Format-Table -AutoSize<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Ensuring proper Domain Controller configuration is key for Active Directory security. Part of this is making sure they are running supported versions of Windows. At this point, DCs should be running at least Windows Server 2016, preferably Windows Server 2019 or 2022. Hold off on deploying Windows Server 2025 DCs for now due to the &hellip; <\/p>\n<p><a class=\"more-link btn\" href=\"https:\/\/adsecurity.org\/?p=4594\">Continue reading<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[565,7,2],"tags":[1469,1476],"class_list":["post-4594","post","type-post","status-publish","format-standard","hentry","category-activedirectorysecurity","category-powershell","category-technical-reference","tag-activedirectorysecuritytip","tag-domaincontrolleroperatingsystemversions","item-wrap"],"_links":{"self":[{"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/posts\/4594","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/adsecurity.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4594"}],"version-history":[{"count":7,"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/posts\/4594\/revisions"}],"predecessor-version":[{"id":4646,"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/posts\/4594\/revisions\/4646"}],"wp:attachment":[{"href":"https:\/\/adsecurity.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4594"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/adsecurity.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4594"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/adsecurity.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4594"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}