How to make CN=Configuration branch visible in AD

[#1]

Many times, Support need to have a look at the Microsoft AD tree for AD internal configuration (e.g. CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration, <domain>). The problem with this part of the AD tree is - it is not visible by default in the AD directory structure.

This article will help the reader to explore the hidden AD tree. Any change in AD should be carried out by the customer’s AD team or admin.

Instructions

Here are the steps:

1. Log on to the AD server
2. Run the ADSIEdit.exe program from Start > Run menu.
3. Select the top-most entry of the left side, and then, select Action > Connect to... from the menu.
   
4. In the next dialog box, select Select a well known Naming Context radio button, and select Configuration from the drop-down menu.
5. Click OK and ADSI Edit will now show CN=Configuration and its sub-tree.
   
6. We can now traverse to CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration, <domain> part easily as seen above.

Example: For Microsoft AD vulnerability (CVE-2021-42282), if the user wants to check the value of dSHeuristics attribute under CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration, <domain>, they can follow the steps above, and then, right-click on CN=Directory Service and select Properties > Attribute Editor and find the value of dSHeuristics attribute.